> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hallwayai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Subprocessor List

> Third-party service providers that process data on behalf of Hallway

**Last Updated:** January 25, 2026

This page lists the third-party service providers ("subprocessors") that Hallway engages to process personal data on behalf of our customers. We update this list when we add or remove subprocessors.

***

## What is a Subprocessor?

A subprocessor is a third-party company that Hallway uses to help provide our Services. These companies may process personal data as part of their services to us.

***

## Current Subprocessors

### Infrastructure & Hosting

| Subprocessor | Purpose                                        | Data Processed                                       | Location      |
| ------------ | ---------------------------------------------- | ---------------------------------------------------- | ------------- |
| **Vercel**   | Application hosting, edge functions, CDN       | Application data, usage logs                         | United States |
| **Supabase** | Database hosting, authentication, file storage | Account data, project data, audio files, transcripts | United States |

### Authentication & Security

| Subprocessor | Purpose                        | Data Processed                    | Location      |
| ------------ | ------------------------------ | --------------------------------- | ------------- |
| **WorkOS**   | Enterprise authentication, SSO | User identity, email, auth tokens | United States |

### AI & Processing Services

| Subprocessor   | Purpose                                          | Data Processed                         | Location      |
| -------------- | ------------------------------------------------ | -------------------------------------- | ------------- |
| **ElevenLabs** | Voice AI for interviews, real-time transcription | Audio streams, conversation data       | United States |
| **OpenAI**     | Insight extraction and analysis (GPT-4o)         | Interview transcripts, project context | United States |

### Payments & Billing

| Subprocessor | Purpose                           | Data Processed                                 | Location      |
| ------------ | --------------------------------- | ---------------------------------------------- | ------------- |
| **Stripe**   | Payment processing, subscriptions | Payment method details, billing history, email | United States |

### Analytics

| Subprocessor | Purpose           | Data Processed                      | Location      |
| ------------ | ----------------- | ----------------------------------- | ------------- |
| **PostHog**  | Product analytics | Usage events, session data, user ID | United States |

### Communications

| Subprocessor         | Purpose                             | Data Processed                      | Location      |
| -------------------- | ----------------------------------- | ----------------------------------- | ------------- |
| **Loops**            | Transactional email, notifications  | Email address, notification content | United States |
| **Google Workspace** | Business email, internal operations | Business communications             | United States |

### Integrations

| Subprocessor  | Purpose                             | Data Processed                   | Location      |
| ------------- | ----------------------------------- | -------------------------------- | ------------- |
| **Relay.app** | Workflow automation between systems | Event data, integration payloads | United States |

***

## Data Processing Details

### ElevenLabs

* **What they do:** Powers our AI voice interview feature
* **Data transmitted:** Real-time audio during interviews
* **Data retention:** Per their enterprise data processing terms
* **Privacy:** [ElevenLabs Privacy Policy](https://elevenlabs.io/privacy)

### OpenAI

* **What they do:** Analyzes transcripts to extract insights
* **Data transmitted:** Interview transcripts and project context
* **Data retention:** Zero data retention via API
* **Privacy:** [OpenAI Privacy Policy](https://openai.com/privacy)

<Info>
  **API Data Handling**

  We use OpenAI's API with zero data retention enabled. Your data is not used to train OpenAI's models.
</Info>

### WorkOS

* **What they do:** Handles enterprise authentication and SSO
* **Data transmitted:** User identity, email address, authentication tokens
* **Privacy:** [WorkOS Privacy Policy](https://workos.com/privacy)

### Stripe

* **What they do:** Processes payments and manages subscriptions
* **Data transmitted:** Payment method details, billing address, transaction history
* **Security:** PCI DSS Level 1 certified
* **Privacy:** [Stripe Privacy Policy](https://stripe.com/privacy)

### PostHog

* **What they do:** Product analytics to improve user experience
* **Data transmitted:** Usage events, session identifiers, user actions
* **Privacy:** [PostHog Privacy Policy](https://posthog.com/privacy)

### Loops

* **What they do:** Sends transactional emails and notifications
* **Data transmitted:** Email address, notification content
* **Privacy:** [Loops Privacy Policy](https://loops.so/privacy)

### Relay.app

* **What they do:** Automates workflows between Hallway and other systems
* **Data transmitted:** Event data, integration payloads
* **Privacy:** [Relay.app Privacy Policy](https://relay.app/privacy)

### Google Workspace

* **What they do:** Provides business email and internal operations
* **Data transmitted:** Business email communications
* **Privacy:** [Google Privacy Policy](https://policies.google.com/privacy)

### Supabase

* **What they do:** Provides our database, authentication, and file storage
* **Data stored:** User accounts, projects, transcripts, audio recordings
* **Security:** SOC 2 Type II certified
* **Privacy:** [Supabase Privacy Policy](https://supabase.com/privacy)

### Vercel

* **What they do:** Hosts our web application and handles traffic routing
* **Data processed:** HTTP requests, application logs
* **Security:** SOC 2 Type II certified
* **Privacy:** [Vercel Privacy Policy](https://vercel.com/legal/privacy-policy)

***

## Security Measures

All subprocessors are required to:

* Maintain appropriate security measures
* Process data only as instructed by Hallway
* Assist with data subject requests
* Notify us of any security incidents
* Delete data upon termination of services

***

## Updates to This List

We may update this subprocessor list from time to time. For enterprise customers with specific notification requirements, please contact us at [help@hallwayai.com](mailto:help@hallwayai.com).

### Notification of Changes

When we add new subprocessors, we will:

1. Update this page with the new subprocessor information
2. Update the "Last Updated" date
3. Notify enterprise customers who have requested notifications

***

## Questions

If you have questions about our subprocessors or data processing:

**Ten for Ten, LLC (d/b/a Hallway)**

Email: [help@hallwayai.com](mailto:help@hallwayai.com)

***

## Related Documents

<CardGroup cols={2}>
  <Card title="Privacy Policy" icon="shield" href="/legal/privacy-policy">
    Learn how we collect and use your information
  </Card>

  <Card title="Terms of Service" icon="file-contract" href="/legal/terms-of-service">
    Read our terms and conditions
  </Card>
</CardGroup>