apronly.

Behind every shift.

Sub-processors
v1.0 · 21 May 2026

Sub-processors

A sub-processor is a third party that processes customer personal data on our behalf. We disclose them here so you always know who's in the loop, what they do, and where the data lives. Required by GDPR Article 28(2).

Active sub-processors

Sub-processor	Role	Data touched	Location	Status
Supabase supabase.com/privacy DPA	Primary backend — Postgres database, authentication, file storage, edge functions, push subscriptions.	Employee records, rota, clock entries, timesheets, documents, vault ciphertext (encrypted on-device, opaque to Supabase), push endpoint URLs.	EU region (Frankfurt) — confirm against your project.	Active
Cloudflare Pages cloudflare.com/privacy DPA	Static asset hosting + CDN — serves the HTML/CSS/JS bundle from edge POPs worldwide.	No customer personal data. Standard HTTP request metadata (IP, user agent) for routing and abuse prevention only.	Global edge · EU + US regions	Active
Apple Push Notification service apple.com/legal/privacy	Web Push relay for users on iOS / macOS Safari that have opted into notifications.	Encrypted push payload (announcement title + body) routed via the device's push endpoint. Apple cannot decrypt content.	Per Apple infrastructure	Active
Google FCM (Firebase Cloud Messaging) policies.google.com/privacy	Web Push relay for Chrome / Android users that have opted into notifications.	Encrypted push payload routed via the device's push endpoint. Google cannot decrypt content.	Per Google infrastructure	Active
Mozilla Autopush mozilla.org/privacy	Web Push relay for Firefox users that have opted into notifications.	Encrypted push payload routed via the device's push endpoint. Mozilla cannot decrypt content.	Per Mozilla infrastructure	Active

Planned (not yet active)

Sub-processor	Role	Data touched	Location	Status
Anthropic (Claude API) anthropic.com/legal/privacy	AI-assisted rota generation — refines automatically-generated shift schedules against natural-language instructions.	Rota constraints (working-hour limits, role mix, rest periods). No employee names or personal identifiers leave apronly. Anthropic does not train on API traffic.	EU / US data centres	Planned

How we notify you of changes. If we add a new sub-processor or change the role of an existing one, we update this page and notify customers via in-app announcement at least 30 days before the change takes effect. Customers with an active DPA who object to a new sub-processor may terminate the affected service.

apronly · Sub-processors list · DPA available on request

Last reviewed 21 May 2026 · Security at a glance · Full one-pager