Sub-processor List
Hemera Intelligence Limited · Last updated: 20 October 2026 · Version 1.2
Sub-processors
The following third-party sub-processors are engaged by Hemera Intelligence Limited in the provision of the HemeraScope service. Each sub-processor processes data only for the purposes described below.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication & user management | User email, name, session data | US (SOC 2 Type II) |
| Vercel, Inc. | Frontend hosting & CDN | Session cookies, page requests | Global (US-headquartered) |
| Render, Inc. | Backend application hosting | All application data in transit through the API, and uploaded evidence files | US (Virginia) |
| Neon, Inc. | Managed Postgres database | All application data at rest | US (Virginia, AWS us-east-1) |
| Anthropic, PBC | AI analysis (classification, risk) | Transaction descriptions, supplier names | US |
| Xero Limited | Accounting data import, where you choose to connect your Xero organisation | Read-only access to bills, invoices, contacts and chart-of-accounts settings for the organisation you connect | US / NZ |
| OpenSanctions | Sanctions and politically-exposed-person screening of suppliers | Supplier, company and director names, sent as lookup queries | EU |
| postcodes.io | UK postcode geocoding for travel and site distance calculations | UK postcodes, sent as lookup queries | UK |
| Resend | Transactional & notification email | Recipient name, email address, message content | US |
| Google LLC (Gmail) | Correspondence inbox: enquiries, support, and data subject rights requests sent to our published contact address | Sender name, email address, message content and any attachments the sender chooses to include | US / global |
Public registries and datasets that HemeraScope reads from, including Companies House, the Environment Agency, the Health and Safety Executive, SBTi and CDP, are data sources, not sub-processors. To resolve a supplier we send its supplier or company name to these registries as a search or lookup query; we do not send them your wider Client Data.
Changes to this list
Not yet in use, and so not processing any data: a payment processor, an error monitoring service and a separate store for evidence files. Each will be added to the table above with its location before it starts.
This list was last updated 20 October 2026. We will notify clients of changes to this list at least 30 days before adding a new sub-processor, in line with our Data Processing Agreement.
If you have questions about our sub-processors, please contact us at hemerascope@gmail.com.