Subprocessors
Subprocessor List
Infrastructure and channel processors confirmed by the current HexSales implementation.- Version
- 2026-08-24
- Effective
- Last updated
Current processors
Supabase
- Purpose
- Authentication, session management, Postgres database and RPC operations, and realtime application data delivery.
- Data categories
- Account and session identifiers; business configuration and knowledge; CRM contacts, conversations and appointments; integration metadata; technical and security metadata.
- Confirmed region
- Primary HexSales projects: eu-west-1 (Ireland)
- Added to list
OpenAI
- Purpose
- Server-side AI response generation and supported tool interpretation when a business has enabled AI.
- Data categories
- Minimised conversation text and the minimum business context needed for a response; model input/output and technical usage metadata. Authentication credentials and integration secrets are not model input.
- Added to list
Vercel
- Purpose
- Hosting the Next.js application, executing server-side application code, and delivering deployment assets.
- Data categories
- HTTP request and response content processed by the application; session and authentication data in transit; deployment, runtime, request, error and security metadata.
- Confirmed region
- Configured application function region: fra1 (Frankfurt)
- Added to list
Fastly
- Purpose
- TLS edge delivery and protected request transport for the branded application domain. Dynamic and private responses are configured not to be cached.
- Data categories
- Client IP and network metadata; HTTP headers and request/response content in transit; timing, routing and security metadata. Only approved immutable public assets may be cached.
- Added to list
Mail.ru SMTP
- Purpose
- Delivery of transactional authentication messages sent by Supabase Auth, such as confirmation, recovery and employee invitation email.
- Data categories
- Recipient email address; sender identity; transactional subject and message body; delivery and SMTP metadata.
- Added to list
Telegram Bot API (optional)
- Purpose
- Inbound and outbound messaging only for a business that explicitly connects its own Telegram bot.
- Data categories
- Bot and chat identifiers; Telegram user identifiers, names and username when supplied; message content; shared contact details; delivery metadata and bot credential used for server-side API calls.
- Added to list
Scope
Telegram is used only for a business that connects its own bot. OpenAI is used only when the business enables AI processing. No analytics, advertising or marketing processor is confirmed in the current application source.