Version 1.0, 2026-10-05.
Subprocessors and integrations
The entities that process personal data so HumanAI can run, what they do, where, and the safeguard when data leaves the European Economic Area (EEA). We give customers at least 30 days' notice by email before adding or replacing a subprocessor, and customers may object within that period (see the Data Processing Agreement). Last updated: 2026-10-05.
| Entity | Service | Data | Entity country | Processing location | Transfer safeguard |
|---|---|---|---|---|---|
| Contabo GmbH | Hosting of servers and of each person's work environment | All platform data | Germany | EU (Germany) | No transfer |
| Supabase, Inc. | Portal database: accounts, teams, configuration, audit log | Name, email, role, account activity | USA | EU (Ireland) | DPA accepted by the company; for support access from the USA, standard contractual clauses or the Data Privacy Framework |
| Plus Five Five, Inc. (Resend) | Platform email | Email, name, message content | USA | EU (Ireland) | DPA accepted by the company; for access from the USA, standard contractual clauses or the Data Privacy Framework |
| Sign in with Google; fallback email; company email used for support | Email, name, Google account ID, content of fallback and support emails | Ireland / USA | EU and USA | Google's data processing terms accepted by the company; Data Privacy Framework or standard contractual clauses | |
| Soniox, Inc. | Voice dictation and meeting transcription, when enabled | Audio and resulting text | USA | EU (the platform only uses the European endpoints) | DPA accepted by the company; European endpoints only |
| Tailscale Inc. | Private network between team devices | Account email, device names and addresses, connection metadata (no content) | USA | Global | DPA accepted by the company; standard contractual clauses or the Data Privacy Framework |
| Browser push services (Google, Mozilla, Apple) | Web Push delivery | A generic end-to-end encrypted message the service cannot read | USA | Global | No readable personal data |
AI integrations enabled by the user. When you enable an AI integration, the content needed for the task (the request, files and code open in the session, tool results) is sent to the selected provider. Processing terms, including retention and training use, depend on the provider and the plan the account was opened with. Using them with a customer's data requires that customer's authorisation. Providers: Anthropic (Claude, USA) and OpenAI (Codex, Ireland / USA), with a DPA accepted by the company, and used with customer data only on business or API plans with standard contractual clauses and no training on the data; Moonshot AI (Kimi, China: no adequacy decision or other safeguard in place; the platform blocks it in projects with EU customers' personal data). Each provider's legal role depends on the actual contract; a consultant's personal subscription is not a contract by the customer, and personal consumer subscriptions are not used with customers' personal data.
Contact: rpad@rpad.pt