Sub-processors
The third parties we use to process customer data on Hyrlo's behalf.
Disclosure version 2026-07-24 · effective 24 July 2026 · superseded
Initial published sub-processor disclosure shipped with the DPA acceptance surface.
Amazon Web Services
Cloud infrastructure, encrypted file storage, and transactional email delivery.
- Data categories
- Account profile data, Organisation and finance records, Uploaded documents, Email metadata
- Primary location
- United Kingdom, European Union, and United States (service-dependent)
- DPA status
- DPA in place
- Added to register
- 24 July 2026
Hyrlo uses AWS services including S3 for file storage and SES for transactional email.
Stripe
Subscription billing, hosted checkout, and payment-processing services for paid plans.
- Data categories
- Billing contacts, Subscription records, Payment metadata
- Primary location
- United Kingdom, European Union, and United States
- DPA status
- DPA in place
- Added to register
- 24 July 2026
Only workspaces using paid plans or payment flows are shared with Stripe.
OpenAI
AI-assisted OCR and document data extraction when the OpenAI OCR provider is enabled.
- Data categories
- Uploaded documents, Extracted receipt or invoice fields
- Primary location
- United States
- DPA status
- DPA in place
- Added to register
- 24 July 2026
Only used for document-processing features when the workspace OCR configuration routes documents through OpenAI.
Cloudflare
Bot protection and abuse prevention on public signup and similar forms.
- Data categories
- IP address, Browser and device signals, Form submission metadata
- Primary location
- Global
- DPA status
- DPA in place
- Added to register
- 24 July 2026
Used to verify public form submissions through Turnstile when enabled.