Service providers and subprocessors

Version 2026-10-30.1 · Published 30 October 2026

How to read this list

This schedule identifies providers designated for ShiftForest’s services. It is version 2026-10-30.1. A provider’s headquarters is not a guarantee of the deployment region or where support access occurs. The customer’s order/deployment record identifies applicable locations and transfer arrangements. Customer-selected integrations are separate recipients chosen by the customer. Changes to appointed subprocessors follow the notice and objection process in the DPA.

Hetzner — infrastructure hosting

Hetzner is the VPS hosting provider designated by ShiftForest for this schedule. Its services support the web application/API infrastructure and associated operational data, including request/security logs and data processed through hosted services. Hetzner Online GmbH is based in Germany; this does not establish the location of a specific server or backup. Deployment location must be recorded separately. Hetzner privacy information.

Supabase — database, authentication and private storage

Supabase provides managed database, account authentication and private object-storage services used by ShiftForest. Relevant data includes workforce records, login/account identifiers, authentication events and customer documents where enabled. Supabase’s published customer DPA identifies Supabase Pte. Ltd; the applicable supplier agreement and configured project region govern the deployment. Do not infer data residency from the company’s headquarters. Supabase data processing information.

Clook — email hosting

Clook Internet, a trading style of Sub 6 Limited, provides the designated email hosting. It processes addresses, message content and delivery/operational records for account email and correspondence using that service. The account-email server is rs07.uk-noc.com; the hostname is not by itself a contractual data-location guarantee. Clook legal and privacy information.

Stripe — payments and billing

Stripe receives billing contacts, business details, payment information, invoice/subscription records and transaction metadata when billing is used. Stripe’s role varies by activity: it may be a processor for some services and an independent controller for financial, fraud-prevention and legal duties. It is not described here as a processor for all activities. The applicable Stripe entity and processing locations follow the merchant agreement and Stripe’s privacy notice. Full payment-card numbers and card security codes are entered into Stripe-hosted payment forms, not stored by ShiftForest. Stripe privacy information.

Resend — application email delivery

Resend (Plus Five Five, Inc.) is designated to deliver application email, including optional onboarding tips, reminders and reviewed announcements. It processes recipient addresses, email content and delivery, bounce and complaint information for messages sent through it. Optional topics require separate account opt-in; authentication password-reset mail continues through the existing Clook/Supabase arrangement. The sending domain is mail.shiftforest.com. An EU sending-region selection does not mean all provider processing stays in the EU; Resend’s DPA describes US processing and transfer safeguards. Open and click tracking are off for this stream. Resend data processing information.

Optional services and deployment information

A planned integration is not automatically an appointed production subprocessor. Before introducing another provider for customer personal data, we will update the applicable schedule and follow the DPA process. Contact hello@theprojecthero.co.uk to request the deployment region, applicable supplier entity, relevant safeguards or to raise a provider objection. No UK-only hosting, support-access or backup-location commitment is made by this list.