Sub-processors
Last updated: April 21, 2026
The following third-party providers (“sub-processors”) process personal data on FocusHQ’s behalf to provide the Service. Each is bound by written data-protection obligations equivalent to those in our Data Processing Agreement.
We notify Team and Enterprise customers by email — and publish an update to this page — at least 14 days before a new sub-processor begins processing customer data, so that customers can object under DPA §8 if they choose.
| Sub-processor | Purpose | Region | Transfer basis |
|---|---|---|---|
| Paddle.com Market Ltd | Merchant-of-record, checkout, subscription billing, invoicing, VAT/sales-tax remittance | Ireland · global | Paddle acts as independent controller for billing data; EU-based |
| Supabase Inc. | Managed PostgreSQL 15 — primary database, pgvector, daily backups, point-in-time recovery | EU (eu-west-1) | Data remains in the EU |
| Railway Corp. | Application hosting — backend API, AI service, BullMQ workers, scheduled jobs | US | SCCs (2021) Module 2 |
| Vercel Inc. | Web dashboard + marketing site hosting, edge caching, serverless functions | US · global edge | SCCs (2021) Module 2 |
| Upstash Inc. | Redis — caching, BullMQ queues, rate limiting, idempotency keys, EventBus streams | US (AWS us-east-1) | SCCs (2021) Module 2 |
| Cloudflare Inc. | DNS, TLS termination, DDoS protection, R2 object storage (attachments, signed DMG hosting) | Global edge | SCCs (2021) Module 2 |
| Anthropic, PBC | Claude AI — triage, drafting, planning, focus recommendations, chat. Zero-retention API tier. | US | SCCs (2021) Module 2 + zero-retention contractual term |
| Voyage AI Innovations Inc. | Text embeddings for semantic search (voyage-3-lite). No training on customer data. | US | SCCs (2021) Module 2 |
| PostHog Inc. | Product analytics (US cluster), feature flags, session replay (opt-in only) | US | SCCs (2021) Module 2 |
| Functional Software, Inc. (Sentry) | Error tracking, crash reports, performance tracing; PII-scrubbing active at ingest | US | SCCs (2021) Module 2 |
| Resend Inc. | Transactional email delivery — welcome, license key, trial lifecycle, billing receipts | US | SCCs (2021) Module 2 |
| Google LLC (Workspace) | Inbound email hosting (support@focushq.app, legal@focushq.app, security@focushq.app) | Global | SCCs (2021) Module 2 |
| Apple Inc. | APNs push notifications for macOS focus-mode updates (opt-in) | US | SCCs (2021) Module 2 |
Not sub-processors
The OAuth integrations you connect to FocusHQ (Gmail, Google Calendar, Slack, Microsoft Outlook/Teams, Notion, Todoist, Linear, Jira, GitHub, Figma, Trello, Zoom, Google Drive, OneDrive, Bitbucket, Confluence) are independent controllers, not FocusHQ sub-processors. They held your data before FocusHQ existed; FocusHQ accesses that data under the scopes you approve and sends nothing back to them beyond actions you explicitly request (e.g. sending a reply, creating a task).
Questions
Email legal@focushq.app with any questions about a specific sub-processor, to request a current copy of the Standard Contractual Clauses we have in place, or to object to a newly-announced sub-processor.