Sub- processors
Every company SessionHQ trusts with a piece of your data, what they do with it, and where they hold it.
Last updated: 2026-07-27. We update this list before onboarding any new sub-processor.Current sub-processors
| Sub-processor | Purpose | Data location |
|---|---|---|
| Supabase | Auth, primary database, file storage | Australia — Sydney (ap-southeast-2) |
| Cloudflare | Hosting, CDN, R2 backups, edge cron | Global edge; backups in R2 (global replicated) |
| Square Australia | Card payment processing | Australia (with fallback to United States for redundancy) |
| Resend | Transactional & lifecycle email delivery | United States |
| Sentry | Error monitoring (with PII scrubbing applied before transmission) | United States |
| Mailchimp (Intuit) | Marketing email delivery for studios that connect it. Receives name, email address, phone number (if provided), signup date, day and month of birthday (never the year), and promotional codes/tags. Only members who gave marketing consent are sent. | United States |
| Brevo (Sendinblue) | Marketing email delivery for studios that connect it, as an alternative to Mailchimp. A studio connects one provider or the other, never both. Receives the same data: name, email address, phone number (if provided), signup date, day and month of birthday (never the year), and promotional codes. Only members who gave marketing consent are sent. | European Union |
Cross-border transfers (APP 8)
The primary database that stores your tenant's member records and check-in history is hosted in Australia. Some sub-processors listed above handle operational data (email delivery, error reports) in the United States. Where that happens, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, including contractual data-processing terms.
Data Processing Agreements
For a DPA, contact info@sessionhq.org.