Last Updated: January 25, 2026
This page lists the third-party service providers (“subprocessors”) that Hallway engages to process personal data on behalf of our customers. We update this list when we add or remove subprocessors.
What is a Subprocessor?
A subprocessor is a third-party company that Hallway uses to help provide our Services. These companies may process personal data as part of their services to us.
Current Subprocessors
Infrastructure & Hosting
| Subprocessor | Purpose | Data Processed | Location |
|---|
| Vercel | Application hosting, edge functions, CDN | Application data, usage logs | United States |
| Supabase | Database hosting, authentication, file storage | Account data, project data, audio files, transcripts | United States |
Authentication & Security
| Subprocessor | Purpose | Data Processed | Location |
|---|
| WorkOS | Enterprise authentication, SSO | User identity, email, auth tokens | United States |
AI & Processing Services
| Subprocessor | Purpose | Data Processed | Location |
|---|
| ElevenLabs | Voice AI for interviews, real-time transcription | Audio streams, conversation data | United States |
| OpenAI | Insight extraction and analysis (GPT-4o) | Interview transcripts, project context | United States |
Payments & Billing
| Subprocessor | Purpose | Data Processed | Location |
|---|
| Stripe | Payment processing, subscriptions | Payment method details, billing history, email | United States |
Analytics
| Subprocessor | Purpose | Data Processed | Location |
|---|
| PostHog | Product analytics | Usage events, session data, user ID | United States |
Communications
| Subprocessor | Purpose | Data Processed | Location |
|---|
| Loops | Transactional email, notifications | Email address, notification content | United States |
| Google Workspace | Business email, internal operations | Business communications | United States |
Integrations
| Subprocessor | Purpose | Data Processed | Location |
|---|
| Relay.app | Workflow automation between systems | Event data, integration payloads | United States |
Data Processing Details
ElevenLabs
- What they do: Powers our AI voice interview feature
- Data transmitted: Real-time audio during interviews
- Data retention: Per their enterprise data processing terms
- Privacy: ElevenLabs Privacy Policy
OpenAI
- What they do: Analyzes transcripts to extract insights
- Data transmitted: Interview transcripts and project context
- Data retention: Zero data retention via API
- Privacy: OpenAI Privacy Policy
API Data HandlingWe use OpenAI’s API with zero data retention enabled. Your data is not used to train OpenAI’s models.
WorkOS
- What they do: Handles enterprise authentication and SSO
- Data transmitted: User identity, email address, authentication tokens
- Privacy: WorkOS Privacy Policy
Stripe
- What they do: Processes payments and manages subscriptions
- Data transmitted: Payment method details, billing address, transaction history
- Security: PCI DSS Level 1 certified
- Privacy: Stripe Privacy Policy
PostHog
- What they do: Product analytics to improve user experience
- Data transmitted: Usage events, session identifiers, user actions
- Privacy: PostHog Privacy Policy
Loops
- What they do: Sends transactional emails and notifications
- Data transmitted: Email address, notification content
- Privacy: Loops Privacy Policy
Relay.app
- What they do: Automates workflows between Hallway and other systems
- Data transmitted: Event data, integration payloads
- Privacy: Relay.app Privacy Policy
Google Workspace
- What they do: Provides business email and internal operations
- Data transmitted: Business email communications
- Privacy: Google Privacy Policy
Supabase
- What they do: Provides our database, authentication, and file storage
- Data stored: User accounts, projects, transcripts, audio recordings
- Security: SOC 2 Type II certified
- Privacy: Supabase Privacy Policy
Vercel
- What they do: Hosts our web application and handles traffic routing
- Data processed: HTTP requests, application logs
- Security: SOC 2 Type II certified
- Privacy: Vercel Privacy Policy
Security Measures
All subprocessors are required to:
- Maintain appropriate security measures
- Process data only as instructed by Hallway
- Assist with data subject requests
- Notify us of any security incidents
- Delete data upon termination of services
Updates to This List
We may update this subprocessor list from time to time. For enterprise customers with specific notification requirements, please contact us at help@hallwayai.com.
Notification of Changes
When we add new subprocessors, we will:
- Update this page with the new subprocessor information
- Update the “Last Updated” date
- Notify enterprise customers who have requested notifications
Questions
If you have questions about our subprocessors or data processing:
Ten for Ten, LLC (d/b/a Hallway)
Email: help@hallwayai.com
