Sub-processor Register
Handover HQ Pty Ltd · ABN 34 689 167 477 · Effective 6 November 2026
1. About This Register
Handover HQ Pty Ltd (ABN 34 689 167 477 · ACN 689 167 477) engages a small number of trusted third-party sub-processors to help deliver the Handover HQ platform. This register lists every sub-processor that may process personal data on our behalf, the purpose of the processing, the categories of data involved, and the hosting location. It supports our Privacy Policy and Data Processing Agreement, and mirrors the live list maintained in our Trust Centre.
For our full security posture, security controls, and compliance roadmap, visit our Trust Centre at trust.handoverhq.ai.
2. Current Sub-processors
The following sub-processors are authorised as at the Effective Date, listed in order of data sensitivity:
| Sub-processor | Purpose | Data Processed | Hosting Region | DPA |
|---|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database, authentication, row-level security | All personal data stored in the Service | Australia (AWS ap-southeast-2, Sydney) | View |
| OpenAI Inc. | AI interview evaluation, summarisation, sentiment analysis (GPT-4o / GPT-4o-mini); voice synthesis of interview questions as a fallback when ElevenLabs is unavailable (tts-1) | Interview question text (including AI-generated follow-up questions) and the employee’s answers as text (transient — not retained or used for training) | United States | View |
| ElevenLabs Inc. | Text-to-speech for the voice AI interview | Text of interview questions, including AI-generated follow-up questions, which may reference the employee’s previous answers | United States | View |
| Resend Inc. | Transactional and lifecycle email delivery | Recipient email addresses, names, handover status notifications | United States | View |
| Stripe, Inc. | Payment processing and subscription billing | Customer billing contact name, email, billing address and payment details (no employee or leaver data) | United States (with EU/AU processing per Stripe’s DPA) | View |
| Sentry (Functional Software, Inc.) | Error monitoring and operational logs | Exception stack traces, request paths, pseudonymous user and record IDs, and operational log messages kept for 30 days. Email addresses are masked in full, including the domain, before they are sent. No interview answers, names or other personal data payloads | United States / European Union | View |
| Vercel Inc. | Frontend hosting and edge delivery | Technical data (IP, headers); no personal data stored at rest | Global edge network (Sydney POP) | View |
| Fly.io, Inc. | .NET application API hosting | Personal data in transit during API requests | Australia (Sydney region) | View |
3. Changes to Sub-processors
We provide at least 30 days’ advance notice before adding or replacing a sub-processor that processes personal data. Customers may object to a change on reasonable data-protection grounds as set out in our Data Processing Agreement.
To subscribe to sub-processor change notifications, email privacy@handoverhq.ai or security@handoverhq.ai.
4. Related Documents
- Privacy and Data Management Policy
- Data Processing Agreement
- Security and Data Protection
- Trust Centre
5. Contact
Privacy Officer — Handover HQ Pty Ltd
Email: privacy@handoverhq.ai
Security: security@handoverhq.ai
Website: handoverhq.ai
Questions about this policy? Email hello@handoverhq.ai.