Sub-processors and service providers
Every third party that processes data on our behalf, in two lists, including group affiliates. Tooling that never receives customer data — source control, design, our VPN — is out of scope and deliberately absent.
Support channels are on the first list because a profile or external ID raised in a shared channel or a support email is your data — an identifier you can resolve to a person is personal data, even though we cannot resolve it ourselves.
Last reviewed .
Sub-processors
Process data we hold on your behalf. These are what your DPA covers.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, and compute for all data processing | All customer health data and derived outputs | United States (us-east-1) |
| Sahha (New Zealand) Limited | Group affiliate: engineering, research and support | Customer health data and derived outputs, accessed by authorised personnel to operate, support and improve the Services. | New Zealand |
| Slack | Support channels shared with customers | Profile and external identifiers, where these come up in a support conversation. No health permissions data or raw wearable data. | United States |
| Microsoft 365 | Support email | Profile and external identifiers, where these come up in a support conversation. | United States |
Service providers
Process our own business data about you rather than data we hold on your behalf, so they sit outside your DPA. Listed because a register you can verify is worth more than a short one.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Netlify | Hosting for the Sahha dashboard web application | Application hosting and account data. No health data: the dashboard fetches it from the Sahha API directly. | United States |
| Auth0 | Authentication for Sahha dashboard users | Dashboard account credentials only. No health data of any kind. | United States |
| Stripe | Billing and subscription management | Billing contact and payment details for the customer account. | United States |
| HubSpot | Customer relationship management | Names and contact details of customer staff we deal with. | United States |
| Attio | Customer relationship management | Names and contact details of customer staff we deal with. | United States |
No health data goes to third-party AI services.
Scores, biomarkers, insights and archetypes are produced by Sahha models running inside Sahha infrastructure on AWS.
Our SOC 2 report lists OpenAI among the tools Sahha uses internally. Health data is not one of the inputs: the report maps user health information to AWS alone.
Changes to this list
The DPA gives 30 days' notice before a new sub-processor begins processing health data. To be added to the notification list, or to raise an objection, email security@sahha.ai.