The subprocessors we use to deliver Hey Support.
We list every third-party service that touches customer data. When we add, change, or remove a subprocessor, this page updates. You'll find the same list referenced in our Privacy Policy and our DPA.
Eight third parties. Nothing else.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, serverless compute, and cookieless marketing-site analytics | All customer data in transit. The analytics covers hey.support visitors only — aggregate page views and page-load speed, with no cookie or cross-session identifier, and never the chat widget or the app | United States |
| Supabase Inc. | Managed Postgres, pgvector, authentication, storage | All customer data at rest, including knowledge base content | United States |
| OpenAI, L.L.C. | Large language model inference and text embeddings via API | Visitor messages, retrieved knowledge chunks for response generation | United States |
| Cartesia AI Inc. | Voice synthesis (text-to-speech) and transcription (speech-to-text) | Audio streams for voice conversations only | United States |
| Stripe, Inc. | Subscription billing, payments, customer portal | Billing identifiers, no chat or knowledge data | United States |
| Razorpay Software Private Limited | Subscription billing and payments for customers in India (UPI AutoPay) | Billing identifiers, no chat or knowledge data | India |
| Resend Inc. | Transactional email delivery | Email addresses and message content for invitations, notifications, password resets | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring | Stack traces, route paths, release and runtime metadata for failures only. Request bodies, query strings, cookies and IP addresses are stripped before transmission, so no chat content, knowledge base content, or lead data is sent. No session recording | United States |
| Google LLC | Marketing site analytics (Google Analytics 4), loaded only after a visitor opts in | Marketing site visitors only: page views, referrer, device, approximate location. No workspace, chat, or knowledge base data | United States |
We don't use any other subprocessor for customer data processing.
Four checks before we add anyone.
Before we add a subprocessor, we check four things:
- They have a SOC 2 Type II report or equivalent audit on file
- Their data processing agreement is enforceable in the jurisdictions our customers operate in
- They commit not to use customer data for model training (where applicable)
- The data they receive is the minimum needed for the function they perform
If any of those fail, we don't add them.
Only after you opt in.
We use Google Analytics 4 on the marketing site, and it loads only after you accept analytics cookies in the consent banner. Advertising and personalization signals stay switched off unless you also accept marketing cookies. No Facebook Pixel, no Google Ads tracking. The marketing site is separate from your workspace and visitor data, and the analytics tag never runs inside the chat widget on your site.
Thirty days. By email if you want it.
When we add or change a subprocessor, we update this page at least thirty days before the change takes effect for paying customers. Enterprise customers receive a direct email at the contact on file.
You can subscribe to changes by emailing [email protected] with the subject “Subprocessor notifications.”
If you object to a new subprocessor, contact us. We'll work with you on an alternative or a transition plan.
Questions land here.
For questions about this list, our processing, or anything related: [email protected]