Sub- processors
Every company SessionHQ trusts with a piece of your data, what they do with it, and where they hold it.
Last updated: 2026-04-15. We update this list before onboarding any new sub-processor.Current sub-processors
| Sub-processor | Purpose | Data location |
|---|---|---|
| Supabase | Auth, primary database, file storage | Australia — Sydney (ap-southeast-2) |
| Cloudflare | Hosting, CDN, R2 backups, edge cron | Global edge; backups in R2 (global replicated) |
| Square Australia | Card payment processing | Australia (with fallback to United States for redundancy) |
| Resend | Transactional & lifecycle email delivery | United States |
| Sentry | Error monitoring (with PII scrubbing applied before transmission) | United States |
Cross-border transfers (APP 8)
The primary database that stores your tenant's member records and check-in history is hosted in Australia. Some sub-processors listed above handle operational data (email delivery, error reports) in the United States. Where that happens, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, including contractual data-processing terms.
Data Processing Agreements
For a DPA, contact info@sessionhq.org.