Sub-processor List

Sub-processor List · hrgoat.ai

hr goat Sub-processor List

Version 2026-10-16. Effective 6 October 2026.

These are the third parties we let process personal data on behalf of our customers. This page mirrors Schedule 4 of the Agreement and is maintained under Schedule 2, clause 9.2.

You get 30 days' notice. Under Schedule 2 clause 9.3, we give at least 30 days' notice before a new sub-processor starts processing customer personal data. You may object within that period on reasonable data protection grounds under clause 9.4, and if we cannot offer a reasonable alternative within 30 days you may terminate the affected service and get a pro rata refund of unused prepaid fees.

To be notified of a change, email legal@hrgoat.ai.

The list

Who the data is about, and what it is

Google Cloud EMEA Limited. Data subjects: employees, workers, applicants, former personnel, Admins and authorised Users. Data: customer data processed through the Service.

Kepler Experience (Pty) Ltd. Data subjects: employees, workers, applicants, former personnel, Admins and authorised Users. Data: customer data accessed only as necessary for authorised support, engineering and product services.

Stripe Payments UK Ltd. Data subjects: customer billing contacts, account owners and persons making payments. Data: billing contact information, invoice information, payment tokens, card metadata, payment status and tax-related information.

Customer.io (Peaberry Software, Inc.). Data subjects: Admins, authorised Users and recipients of Service communications. Data: name, email address, workspace identifiers, message content and delivery, open and engagement metadata.

Amazon Web Services EMEA SARL (Amazon SES). Data subjects: Admins, authorised Users and recipients of Service communications. Data: name, email address and the content of transactional messages.

Phiresky (Pty) Ltd. Data subjects: employees, workers, applicants, former personnel, Admins and authorised Users. Data: customer data included in a support or engineering ticket, test data, and customer data presented in dashboards and reports.

Anthropic, PBC. Data subjects: employees, workers, applicants, former personnel, Admins and authorised Users. Data: customer data only where an engineering, quality assurance or support task requires access to data containing it. Synthetic or anonymised data is used wherever the task permits.

Meta Platforms Ireland Limited. Data subjects: employees, workers, applicants, former personnel, Admins and authorised Users. Data: message content an authorised user asks for, their registered phone number and delivery metadata. Sensitive information is never sent.

Apple Distribution International Ltd and Google Ireland Limited. Data subjects: Admins and authorised Users of the mobile apps. Data: a notification token and the notification itself. Previews never include sensitive information.

AI runs inside Google Cloud

hr goat's AI features are served through Google Vertex AI, in the same Google Cloud region and environment that hosts the rest of the platform. Customer data does not leave that environment to reach a model. No other AI provider sits in the path of anything you or your people ask the assistant to do.

Anthropic, PBC appears on the list above for a different reason. It supplies an internal engineering tool our own developers use to build and support hr goat, which can reach customer data when an engineering, quality assurance or support task requires it. It is not part of the Service, it is not reached by any customer request, and it is barred by contract from training on anything it sees. We list it because it can touch the data, not because it answers anybody's question.

We may route a request between models supplied by that same approved sub-processor. Under clause 35.3 of the Agreement, routing is only permitted where it does not reduce data protection, change the disclosed processing location, permit training on customer data, or bring in a new sub-processor. If we ever introduce a model published by a third party, that publisher becomes a sub-processor and goes on this page with 30 days' notice first.

No training. Neither we nor our AI sub-processors use customer data to train, fine-tune or improve a foundation model or a generally available machine-learning model. That is clause 35.1 of the Agreement and clause 14.2 of the Data Processing Addendum.

Where the data sits

Production personal data is hosted in Google Cloud's europe-west1 region in St Ghislain, Belgium, which is inside the European Economic Area.

Engineering, product and support personnel at Kepler Experience (Pty) Ltd, 1 Sturdee Avenue, Rosebank, Johannesburg, may access that Belgian environment remotely. For UK-origin data the UK International Data Transfer Addendum applies; for EEA-origin data the EU Standard Contractual Clauses under Decision (EU) 2021/914 apply.

Product and system email is delivered by Customer.io from an Ireland data centre and by Amazon SES from eu-west-1 in Ireland, both inside the EEA.

Phiresky (Pty) Ltd supplies our issue tracking, testing and reporting tools. Those run on Google Cloud in Europe, and the supplier is established in South Africa, so support access may occur from South Africa on the same footing as our own engineering access.

Anthropic, PBC processes in the United States. For restricted transfers to South Africa and the United States, the UK International Data Transfer Addendum applies to UK-origin data and the EU Standard Contractual Clauses under Decision (EU) 2021/914 apply to EEA-origin data, in each case with a transfer risk assessment and supplementary controls.

We will not move primary production hosting outside the EEA without at least 30 days' notice, and you may object using the same process as for a new sub-processor.

WhatsApp messages pass through Meta in Ireland. App notifications are delivered by Apple from Ireland and by Google under its own documentation. All three apply their own transfer safeguards if anything leaves the EEA.

Services you connect yourself

These are not our sub-processors. They process personal data only if you choose to connect them, and when you do, you authorise that transfer and own the onward relationship.

Note on meeting AI tools. Fireflies, Fathom and Otter.ai record and transcribe meetings. If you connect one, recordings and transcripts of your employees flow between that provider and hr goat at your direction. Recording carries consent obligations in several jurisdictions, and in South Africa the Regulation of Interception of Communications Act applies. Those obligations sit with you as controller, not with us.

How we pick and manage a sub-processor

Before engaging one, we:

1. carry out due diligence on it
2. put written data protection terms in place that are no less protective than our own
3. check the processing location and put an appropriate transfer mechanism in place
4. impose confidentiality and security requirements
5. limit the data shared to what the function actually needs

We review each one periodically. We remain responsible to you for a sub-processor's performance to the extent the data protection laws require.

Individual contractors engaged by Kepler Experience (Pty) Ltd who have production access are not separate sub-processors. They work under the company's direction, under signed confidentiality agreements, the same access controls and the same logging as employees.

Change log

Every addition, removal or change of region gets a line here. A published row is never edited silently. Enterprise reviewers read the change log before they read the table.