Sub-Processor List
Effective Date: February 26, 2026
Last Updated: February 26, 2026
Version: 1.0
Related Documents: Privacy Policy Section 6 | Terms of Service Section 18
1. About This Page
1.1. Henry AI (Pty) Ltd ("we", "us", "our") engages the sub-processors listed below to assist in providing our services. This page is the authoritative list of all sub-processors.
1.2. In accordance with our Privacy Policy Section 6.5, we will provide at least 30 days' advance notice before engaging a new sub-processor. Changes will be reflected on this page and notified to all tenants via email.
1.3. To subscribe to sub-processor change notifications or to object to a new sub-processor, contact: privacy@henryapi.ai
2. Current Sub-Processors
2.1 Infrastructure & Hosting
| Sub-Processor | Service | Data Processed | Location | DPA in Place |
|---|---|---|---|---|
| Supabase | Database hosting, authentication, Row Level Security | All user data, emails, documents, encrypted PII | USA | Yes |
| Amazon Web Services (AWS) | File storage (S3), Lambda functions | Email attachments, document files, data exports | South Africa (af-south-1) | Yes |
2.2 AI / Machine Learning
| Sub-Processor | Service | Data Processed | Location | DPA in Place |
|---|---|---|---|---|
| Google (Gemini) | Email classification, document classification, PII redaction, OCR, "Chat with Data", insight generation | Document and email text, user queries, data context | USA | Yes |
| Mistral AI | Document text extraction, OCR processing | Document text, attachment content | France | Yes |
Note: Your data is not used to train or fine-tune any third-party AI models. All AI processing is inference-only. See Privacy Policy Section 3A for details.
2.3 Integrations
| Sub-Processor | Service | Data Processed | Location | DPA in Place |
|---|---|---|---|---|
| Microsoft | OAuth integration (Outlook, SharePoint, OneDrive, Teams) | Email, calendar, contacts, SharePoint data, OneDrive files, Teams messages and files | USA | Yes |
2.4 Analytics
| Sub-Processor | Service | Data Processed | Location | DPA in Place |
|---|---|---|---|---|
| PostHog | Product analytics (cookieless) | Anonymized usage data, event telemetry, device/browser metadata | USA | Yes |
2.5 Internal Business Operations
These processors are used for Henry AI's internal business operations and do not process tenant customer data.
| Sub-Processor | Service | Data Processed | Location | DPA in Place |
|---|---|---|---|---|
| Microsoft 365 | Internal productivity tools | Business operations data, employee communications | USA | Yes |
| Zoho | Internal productivity tools | Business operations data, usage data | USA / India | Yes |
3. Change Log
| Date | Change | Sub-Processor | Details |
|---|---|---|---|
| 2026-02-26 | Initial publication | All | First version of standalone sub-processor list |
4. Your Rights
4.1. Objection: You may object to a new sub-processor within 30 days of notification. Submit objections to privacy@henryapi.ai with your reasoning.
4.2. Resolution: If we cannot reasonably accommodate your objection, you may terminate your subscription in accordance with the Terms of Service.
4.3. Transparency: You may request additional information about any sub-processor's data processing practices and safeguards by contacting privacy@henryapi.ai.
5. Contact
For questions about our sub-processors:
- Privacy: privacy@henryapi.ai
- Legal: legal@henryapi.ai
- Security: security@henryapi.ai
END OF SUB-PROCESSOR LIST