Snapshot 231695
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Sub-processors and service providers Every third party that processes data on our behalf, in two lists, including group affiliates. Tooling that never receives customer data — source control, design, our VPN — is out of scope and deliberately absent. Support channels are on the first list because a profile or external ID raised in a shared channel or a support email is your data — an identifier you can resolve to a person is personal data, even though we cannot resolve it ourselves. Last reviewed August 30, 2026. Sub-processors Process data we hold on your behalf. These are what your DPA covers. Sub-processor Purpose Data processed Location Amazon Web Services (AWS) Cloud hosting, storage, and compute for all data processing All customer health data and derived outputs United States (us-east-1) Sahha (New Zealand) Limited Group affiliate: engineering, research and support Customer health data and derived outputs, accessed by authorised personnel to operate, support and improve the Services. New Zealand Slack Support channels shared with customers Profile and external identifiers, where these come up in a support conversation. No health permissions data or raw wearable data. United States Microsoft 365 Support email Profile and external identifiers, where these come up in a support conversation. United States Service providers Process our own business data about you rather than data we hold on your behalf, so they sit outside your DPA. Listed because a register you can verify is worth more than a short one. Provider Purpose Data processed Location Netlify Hosting for the Sahha dashboard web application Application hosting and account data. No health data: the dashboard fetches it from the Sahha API directly. United States Auth0 Authentication for Sahha dashboard users Dashboard account credentials only. No health data of any kind. United States Stripe Billing and subscription management Billing contact and payment details for the customer account. United States HubSpot Customer relationship management Names and contact details of customer staff we deal with. United States Attio Customer relationship management Names and contact details of customer staff we deal with. United States No health data goes to third-party AI services. Scores, biomarkers, insights and archetypes are produced by Sahha models running inside Sahha infrastructure on AWS. Our SOC 2 report lists OpenAI among the tools Sahha uses internally. Health data is not one of the inputs: the report maps user health information to AWS alone. Changes to this list The DPA gives 30 days' notice before a new sub-processor begins processing health data. To be added to the notification list, or to raise an objection, email trust@sahha.ai.