Sub-processor list

Last updated: 26 April 2026 · Next review: October 2026

WorkHive is operated by SJC Distributions Limited, a UK company. To deliver the service, we engage the following sub-processors. We have a Data Processing Agreement (DPA) in place with each, and they each have an established record of UK GDPR compliance.

If we change our sub-processors, we will update this page at least 30 days in advance for material changes (and customers can object via hello@workhive.co.uk).

Active sub-processors

Sub-processor	Purpose	Data type	Location	Compliance
Supabase Inc. supabase.com	Database, file storage, authentication	All customer data (encrypted)	EU-West-2 (London) 🇬🇧	SOC 2 Type 2, HIPAA, ISO 27001 (in progress). DPA executed.
Netlify Inc. netlify.com	Web hosting, serverless functions, CDN	HTTP request metadata, function logs (no PII stored)	Global CDN, primary region: US-East	SOC 2 Type 2, GDPR Standard Contractual Clauses (SCCs).
Resend Inc. resend.com	Transactional email (welcome, password reset, payslip notifications)	Recipient name + email + email content	EU region (Frankfurt)	GDPR-compliant. DPA executed.
Twilio Inc. twilio.com	SMS notifications (shift reminders, alerts)	Recipient name + phone + SMS content	UK / EU region selectable; we route via UK	SOC 2 Type 2, ISO 27001, GDPR SCCs.
Anthropic PBC anthropic.com	HR Helper AI assistant (only when org has enabled it in Settings)	Manager queries + relevant staff details when explicitly asked about a person	US (with EU regional option)	SOC 2 Type 2. Does not train models on customer data per Anthropic's commercial terms. Data Processing Addendum executed.
123-reg 123-reg.co.uk	Domain registration + DNS only	None — no customer data flows through	UK 🇬🇧	UK-based registrar. No DPA needed (no PII processed).

Optional sub-processors (only used if owner enables a feature)

Sub-processor	Purpose	Triggered when
Anthropic (HR Helper)	AI-generated employment-law guidance and ACAS template letters	Owner enables HR Helper in Settings + manager accepts disclaimer

What never happens

We do not sell, rent or share customer data with third parties for marketing.
We do not train AI models on customer data.
We do not use customer data outside the purposes set out in the DPA.
We do not transfer customer data outside the UK/EEA except via SCCs and only where necessary (e.g. Anthropic's US infrastructure for AI inference).

Reporting concerns

If you have concerns about how a sub-processor handles your data, contact privacy@workhive.co.uk. You also have the right to lodge a complaint directly with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.