Sub-processors
Last updated: January 2026
Hilma (operated by Mindtrack AB) uses the following third-party sub-processors to provide our services. We carefully vet each sub-processor for security and privacy compliance.
Infrastructure Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, edge functions, CDN | Global Edge Network, Functions: Stockholm (arn1), Frankfurt (fra1), Washington D.C. (iad1) |
| Supabase Inc. | Database hosting (PostgreSQL), authentication, realtime | EU (AWS eu-central-2, Zurich) |
| Amazon Web Services (AWS) | Cloud infrastructure (via Supabase) | EU (Zurich) |
AI & Processing Sub-processors
| Sub-processor | Purpose | Data Retention |
|---|---|---|
| OpenAI, L.L.C. | AI-powered summaries, wellness coaching, text analysis | Zero retention (API usage only, data not used for model training) |
| Anthropic PBC | AI-powered summaries, wellness coaching, text analysis | Zero retention (API usage only, data not used for model training) |
Communication Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Resend Inc. | Transactional email delivery (notifications, digests) | United States |
Payment Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Paddle.com Market Limited | Payment processing, subscription management, invoicing (Merchant of Record) | United Kingdom |
Platform Partners
Hilma integrates with the following platforms. These are not sub-processors but platform partners through which our service operates:
- Slack Technologies, LLC - Workplace messaging platform integration
- Microsoft Corporation - Microsoft Teams integration
Optional Integration Sub-processors
When customers connect optional integrations, the following sub-processors may be involved:
| Sub-processor | Purpose |
|---|---|
| ClickUp | Task activity surfacing (when connected by customer) |
| Linear | Issue activity surfacing (when connected by customer) |
| Atlassian (Jira) | Issue activity surfacing (when connected by customer) |
| Asana | Task activity surfacing (when connected by customer) |
Data Transfer Mechanisms
For transfers of personal data from the EU/EEA to sub-processors outside the EU/EEA, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Sub-processor certifications and compliance programs
- Supplementary technical measures (encryption, access controls)
Changes to Sub-processors
We will notify customers of any changes to this list at least 30 days before adding a new sub-processor. Customers may object to new sub-processors by contacting us at [email protected].
Contact
For questions about our sub-processors, contact us at [email protected].
Mindtrack AB
Organization number: 559383-2859
Sweden