Sub-processors
The companies that process personal data for WebHR, where they are, and what they handle.
Last updated: 28 September 2026
Who processes data for us
These companies process personal data on WebHR’s behalf to run the service. Each is bound by a data processing agreement with obligations equivalent to ours.
| Sub-processor | Entity and location | Purpose | Data involved | Applies to |
|---|---|---|---|---|
| Contabo | Contabo GmbH, Germany | Hosting of servers and database | All workspace data | Every workspace |
| Brevo | Sendinblue SAS, France | Platform email: invitations, password resets, notifications | Name, email address, message content | Every workspace that does not send from its own address |
| Firebase Cloud Messaging | Google LLC, USA | Mobile push notifications | Device token, notification text | People who allow push notifications |
| Browser push services | Google, Mozilla, Apple (USA) | Web push notifications | Push endpoint, notification text | People who allow push notifications |
Chosen by the customer, not by us
A workspace can connect these services itself. The customer’s own contract with them applies; we list them so you can see where data may go.
| Service | Used for |
|---|---|
| SendGrid (Twilio Inc., USA), Gmail API (Google LLC), or the customer’s own mail server | The workspace’s own outbound email, if the customer sets it up |
| OpenAI, Anthropic, Google Gemini, OpenRouter, Microsoft Azure OpenAI, Emergent | The in-app AI assistant, if the customer switches it on and supplies its own key |
Changes to this list
We give 30 days’ notice of a new sub-processor on this page and by email to account owners. A customer may object on reasonable data-protection grounds, as our Data Processing Agreement sets out.
See also our Data Processing Agreement and Privacy Policy.
Ready to make HR feel effortless?
Join 5,000+ companies replacing spreadsheets and legacy HRMS with WebHR. Setup in 7 days. First 14 days free.