Sub-processors

Version 1.1 · Effective 26 October 2026 · Last updated 26 October 2026

Harriet (JustParent Ltd, company number 14338607) uses the following sub-processors to provide the Harriet platform, website, and related services.

We give customers at least 30 days' notice before adding or replacing a sub-processor (see our DPA). To subscribe to change notifications, email legal@harriethq.com.

Related documents: DPA · Privacy policy · Terms of use

Platform and infrastructure

Sub-processor Function Location Transfer mechanism
Salesforce (Heroku) Application hosting and infrastructure United States / EU regions UK IDTA / EU SCCs + UK Addendum
Amazon Web Services Cloud storage (S3), email (SES), and related infrastructure (excluding AI inference; see AI and automation) EU (Ireland) and other regions as configured UK IDTA / EU SCCs + UK Addendum; adequacy where applicable
Modal Labs Isolated sandboxes that run hosted connectors and cloud workspaces, including content from connected apps while a session runs United States / EU (compute pinned to the EU for customers who require it; storage in the United States) UK IDTA / EU SCCs + UK Addendum; DPF where applicable

AI and automation

Sub-processor Function Location Transfer mechanism
Amazon Web Services (Bedrock) LLM API for chat and workflow features via AWS Bedrock, including EU-hosted Anthropic models where configured (sub-processor; Customer Data shared to generate responses; not used for model training; limited retention per provider terms) EU (Ireland) / United States UK IDTA / EU SCCs + UK Addendum; adequacy where applicable
OpenAI LLM API for chat and workflow features (sub-processor; Customer Data shared to generate responses; not used for model training; limited retention per provider terms) United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Anthropic LLM API for chat and workflow features (sub-processor; Customer Data shared to generate responses; not used for model training; limited retention per provider terms) United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Google (Cloud / Gemini) LLM API and related cloud services (sub-processor; Customer Data shared to generate responses; not used for model training; limited retention per provider terms) United States / EU UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Microsoft (Azure OpenAI) LLM API for EU-hosted GPT models (sub-processor; Customer Data shared to generate responses; not used for model training; limited retention per provider terms) EU UK IDTA / EU SCCs + UK Addendum; adequacy where applicable
Baseten Hosting for open-weight models (DeepSeek, Kimi, GLM) through its Model APIs (sub-processor; Customer Data shared to generate responses; not used for model training; zero data retention) United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
TensorX Hosting for open-weight models in the EU (sub-processor; Customer Data shared to generate responses; not used for model training; zero data retention) EU UK IDTA / EU SCCs + UK Addendum; adequacy where applicable
Groq LLM API for optional open-weight chat models (sub-processor; Customer Data shared to generate responses; not used for model training; not retained by default) United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Perplexity Web search tool (sub-processor; queries and supporting context shared to generate responses; not used for model training; zero data retention) United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Microsoft Optional Teams integration, authentication, and mailbox features United States / EU UK IDTA / EU SCCs + UK Addendum; DPF where applicable

AI models and data handling

Current model availability and EU hosting are on our Models page. This table shows the models each provider serves for Harriet and what the provider does with data under the commercial terms Harriet uses. We checked it against each provider's published terms on 26 October 2026. The provider's terms govern.

Provider Models Terms Training on Customer Data Retention
OpenAI GPT 6.1, GPT 6, GPT 5.6, GPT 5.5, GPT 5.4, GPT 5.2 and GPT 5 families, GPT 4.1, GPT 4o and o-series reasoning models Commercial API terms Not used Up to 30 days for abuse monitoring; zero data retention available for eligible customers
Anthropic Claude Fable, Opus, Sonnet and Haiku families, including Fable 5, Opus 5.5, Sonnet 5.5 and Haiku 5.5 Commercial API terms Not used Deleted within 30 days, with limited exceptions for policy enforcement and law; zero data retention available for eligible models (Anthropic keeps some newer models, such as Fable 5, outside it)
Amazon Bedrock (EU, Ireland) Anthropic Claude Opus 5.5, 5, 4.8 and 4.7, Sonnet 5.5 and 5, and Haiku 4.5 AWS terms Not used Model providers do not receive prompts or completions; AWS may retain them to detect abuse
Microsoft Azure OpenAI (EU) GPT 6.1, GPT 6 and GPT 5.6 families, and earlier GPT models Microsoft product terms Not used Not available to OpenAI; Microsoft abuse monitoring applies
Google Gemini API Gemini 3.1 Pro (preview), Gemini 3.8, 3.7, 3.6, 3.5 and 3 Flash, Gemini 3.1 Flash Lite, and earlier Gemini models Paid Services terms Not used Logged for a limited period to detect abuse
Baseten DeepSeek V4 Pro and V4.1 Flash, Kimi K3, GLM 5.2 and 5.3 Commercial terms Not used Zero data retention
TensorX (EU) DeepSeek V4.1 Flash, Kimi K3, GLM 5.3 and GLM 5.3 Flash Commercial terms Not used Zero data retention
Groq Llama 3.3 70B and Mixtral 8x7B (optional chat models) Commercial terms Not used Not retained by default; may be logged for up to 30 days to investigate reliability issues or abuse
Perplexity Sonar Pro (web search tool) API terms Not used Zero data retention

Communications and support

Sub-processor Function Location Transfer mechanism
Mailgun (Sinch) Transactional email delivery EU UK IDTA / EU SCCs + UK Addendum
Slack Technologies Optional customer integration and notifications United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Google Optional Google Chat integration and notifications United States / EU UK IDTA / EU SCCs + UK Addendum; DPF where applicable

Payments and billing

Sub-processor Function Location Transfer mechanism
Stripe Payment processing and billing United States / EU UK IDTA / EU SCCs + UK Addendum; DPF where applicable

Analytics, monitoring, and marketing

Sub-processor Function Location Transfer mechanism
PostHog Product analytics (consent-gated on website) EU / United States UK IDTA / EU SCCs + UK Addendum
Google (Analytics / Tag Manager) Website analytics and advertising tags United States UK IDTA / EU SCCs + UK Addendum; DPF where applicable
Attio CRM for sales enquiries United Kingdom / EU / United States EU SCCs + UK Addendum; adequacy where applicable
Sentry Error monitoring and application performance United States / EU UK IDTA / EU SCCs + UK Addendum

Notes

  • Customer-enabled integrations (for example Slack, Microsoft Teams, Google Chat, or a specific HRIS) process data only when Customer configures them.
  • LLM providers are sub-processors: relevant Customer Data is shared with them to deliver AI features. They are contractually required not to use Customer Data for model training. Limited retention may apply for service delivery, abuse prevention, and compliance. See our Privacy policy and DPA.
  • Customer-chosen routes. Customers can use their own provider API keys, connect their own model server (for example vLLM), or use Harriet's connectors from AI clients of their choice (for example Claude Desktop or Cursor). In those cases the provider or client is the customer's own supplier, not a Harriet sub-processor, and the customer's agreement with it governs how data is handled.
  • Google user data. Data received from Google APIs follows the Limited Use requirements. See the Google user data section of our privacy policy.
  • This list covers sub-processors used to deliver the Services and operate our website. It is updated when we add or replace providers.

Contact

Questions about sub-processors: legal@harriethq.com