Subprocessors
We keep this list current. Whenever we plan to add a new subprocessor or replace an existing one, we will post the change here at least 30 days in advance and notify accounts that have opted in to subprocessor updates by email.
Effective: 13 May 2026
Each subprocessor below is contractually bound to (a) process Customer Data only on Hasb's documented instructions, (b) maintain confidentiality, (c) apply security measures no less protective than ours, and (d) assist with data-subject rights, breach notification, and audit.
Infrastructure
| Subprocessor | Purpose | Location |
|---|
| DigitalOcean LLC | Compute, networking, object storage for Customer Data and backups. | United States · primary region serving UAE / EMEA |
| Cloudflare, Inc. | CDN, DDoS protection, WAF, inbound email routing. | Global edge |
AI inference
| Subprocessor | Purpose | Location |
|---|
| Ollama, Inc. — Ollama Cloud | Hosted large-language-model inference for Hasb AI chat replies. No training on Customer Data; logs short-lived. | United States |
| Anthropic, PBC (standby) | Standby AI provider, used only if explicitly selected. | United States |
Email & communications
| Subprocessor | Purpose | Location |
|---|
| Cloudflare Email Routing | Inbound email forwarding for our @hasb.ai aliases. | Global edge |
| Self-hosted Postfix + OpenDKIM | Outbound transactional email (magic-link, billing, security alerts) from our droplet. | UAE / US region |
Payments
| Subprocessor | Purpose | Location |
|---|
| Stripe, Inc. | Card processing, subscription billing, tax handling. PCI-DSS Level 1 certified. | United States · EU subsidiaries |
Observability
| Subprocessor | Purpose | Location |
|---|
| Sentry (Functional Software, Inc.) | Pseudonymised crash + performance telemetry. Customer Data is scrubbed before transmission. | United States · EU region available |
Document AI
| Subprocessor | Purpose | Location |
|---|
| Google Cloud — Document AI | OCR + structured-field extraction for uploaded receipts and invoices. Processed under Google's data-processing addendum; no training on Customer Data. | EU region |
Object to a subprocessor
If you have a specific data-protection objection to a proposed or current subprocessor, email dpo@hasb.ai within 30 days of the change being published. We will work with you in good faith to address the objection; if a resolution cannot be reached, you may terminate the affected subscription without penalty for the unused term.