Sub-processors

The companies that help us run TopTimesheets and may process your data.

Draft — needs legal reviewThis text is a working draft. It has not been reviewed by a lawyer and is not yet a binding document.

Last updated 29 October 2026

How we use sub-processors

We use a small number of service providers. Each one gets only the data it needs, under a written contract with data-protection terms at least as strict as our data processing agreement.

Some are used only when a customer turns a feature on: WhatsApp, the AI assistant, Google sign-in, and e-mail delivery through an SMTP provider. If a customer turns AI features off, nothing of theirs is sent to the AI model provider.

We will announce a new sub-processor on this page at least 30 days before it starts processing customer data, so customers can object.

Current sub-processors

Cloudflare, Inc.

Purpose: Network, DNS, TLS and protection against attacks
Data: All traffic in transit, IP addresses
Location: Global network; USA
When used: Always

Our server hosting provider

Purpose: The server that runs the service, its database and files
Data: All customer data, stored encrypted where stated
Location: To be named in the agreement before launch
When used: Always

Stripe, Inc.

Purpose: Subscriptions and card payments
Data: Billing contact, company name, payment details (held by Stripe)
Location: USA, EU
When used: Paid plans

Anthropic, PBC

Purpose: AI model for the assistant
Data: Questions and the records needed to answer them; phone numbers, e-mails, coordinates and bank data are removed first
Location: USA
When used: Only while the customer's AI features are on

Meta Platforms (WhatsApp Business)

Purpose: Clock-in by WhatsApp and reminders
Data: Phone number, message text, shared location
Location: Global
When used: Only when the customer turns WhatsApp on

E-mail delivery provider

Purpose: Invitations, reminders and account e-mails
Data: E-mail address, message content
Location: To be named when configured
When used: When e-mail sending is configured

Google LLC

Purpose: Sign in with Google
Data: Name, e-mail address
Location: USA
When used: Only if a user chooses Google sign-in

Map tile provider

Purpose: Maps for sites and geofences
Data: IP address and the map area viewed (no worker data)
Location: To be named before launch
When used: When a manager opens a map

Current sub-processors
Provider	Purpose	Data	Location	When used
Cloudflare, Inc.	Network, DNS, TLS and protection against attacks	All traffic in transit, IP addresses	Global network; USA	Always
Our server hosting provider	The server that runs the service, its database and files	All customer data, stored encrypted where stated	To be named in the agreement before launch	Always
Stripe, Inc.	Subscriptions and card payments	Billing contact, company name, payment details (held by Stripe)	USA, EU	Paid plans
Anthropic, PBC	AI model for the assistant	Questions and the records needed to answer them; phone numbers, e-mails, coordinates and bank data are removed first	USA	Only while the customer's AI features are on
Meta Platforms (WhatsApp Business)	Clock-in by WhatsApp and reminders	Phone number, message text, shared location	Global	Only when the customer turns WhatsApp on
E-mail delivery provider	Invitations, reminders and account e-mails	E-mail address, message content	To be named when configured	When e-mail sending is configured
Google LLC	Sign in with Google	Name, e-mail address	USA	Only if a user chooses Google sign-in
Map tile provider	Maps for sites and geofences	IP address and the map area viewed (no worker data)	To be named before launch	When a manager opens a map