Subprocessors
Effective · Version 2026-05-14
WiseHQ uses the third-party services listed below to operate the Service. Each is bound by its own DPA / privacy commitments. Customer data is processed only as needed to deliver the WiseHQ product.
Active subprocessors
The table below is current as of the effective date above. We will notify Owners by email at least 30 days before adding a new subprocessor that processes customer data, so customers may object in line with their DPA.
| Service | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase | Database, file storage, authentication | All customer data (records, files, audit logs) | US East (default); EU on request |
| Vercel | Application hosting, edge functions, CDN | HTTP request metadata, request bodies in transit (not stored) | Global edge network |
| Stripe | Payment processing, billing portal, tax | Billing email, payment method (held by Stripe — never touches WiseHQ servers), invoices | US |
| Anthropic | AI Assistant (Claude API) | Prompts you submit + relevant scoped context (e.g. work-order text, asset names). Anthropic does not retain prompt data beyond 30 days and does not train on customer data. | US |
| Resend | Transactional email (invitations, expiration reminders, password resets) | Recipient email, subject + body of transactional messages | US |
| Planning Center (optional) | Calendar + people sync (only when org connects integration) | OAuth tokens, calendar/people records the org chooses to sync | US |
| Google (optional) | Calendar sync + Sign-in with Google (only when used) | OAuth tokens, calendar event metadata, Google profile (name, email, avatar) | Global (Google infrastructure) |
| Cloudflare | DNS, DDoS protection at the domain edge | HTTP request metadata (IP, user agent, URL); no request bodies inspected | Global edge |
Optional integrations
Several subprocessors are activated only when an organization connects an integration (e.g. Planning Center, Google Calendar). If your organization does not enable an integration, no data is shared with that subprocessor.
Sub-subprocessors
Each subprocessor above relies on its own infrastructure providers (e.g. Supabase runs on AWS; Vercel uses AWS / Cloudflare). Those relationships are governed by the subprocessor’s own DPA, which is linked above.
Notification of changes
We will email Owners at legal@getwisehq.com at least 30 days before adding a new subprocessor that processes customer data. Customers may object in writing during that window per the terms of their Data Processing Agreement.
Questions
For Data Processing Agreement requests or subprocessor questions: legal@getwisehq.com.
Questions? legal@getwisehq.com