Compliance
Subprocessors
Third parties that support HyperMemory's delivery and may process personal data
Subprocessors
HyperMemory uses selected third parties to operate, secure, and support the services. A subprocessor is a third party engaged by HyperMemory to process personal data on behalf of a customer when HyperMemory is acting as a processor. This register also identifies controller-side service providers when the distinction helps customers understand account, billing, support, website, or compliance processing. A provider receives data only when the corresponding feature or business process is used.
This page is a public transparency summary. A customer’s signed agreement and Data Processing Addendum govern the parties’ obligations.
Core infrastructure
These providers host the production service or store service data.
| Subprocessor | Purpose of processing | Primary processing location |
|---|---|---|
| Hetzner Online GmbH | Production compute, networking, server backups, attached storage, and S3-compatible object storage. Service content, files, account identifiers, and operational metadata may be processed on this infrastructure. | Germany and other selected European Union locations |
| Supabase Pte. Ltd. | Authentication and account identity services, including login identifiers, authentication records, and account metadata. | European Union for the configured project region; limited support and operational processing may occur elsewhere under Supabase’s terms |
Product and platform services
These providers perform functions requested through the HyperMemory product.
| Subprocessor | Purpose of processing | Primary processing location |
|---|---|---|
| OpenRouter, Inc. | Routes approved language-model and reranking requests used for memory enrichment, document processing, and recall quality. Request content and associated technical metadata may be sent for inference. | United States and the region of the selected model provider |
| Unstructured Technologies, Inc. | Parses uploaded documents and may perform text extraction or OCR before the content is incorporated into a customer’s memory graph. | United States |
| Brave Software, Inc. | Processes search queries for note lookups, research, and other user-requested search features. Brave states that it does not receive end-user identifiers with the query; HyperMemory still treats query content as potentially personal within its own context. | United States |
| Bright Data Ltd. | Reads public web pages, images, and supported platform pages when a user invokes a feature that requires external page retrieval and direct retrieval is insufficient. | Global infrastructure, including the United States and other provider locations |
Customer and business operations
These providers support account, billing, service communications, support, analytics, business records, compliance evidence, or public websites. They may act as processors, independent controllers, or both depending on the activity.
| Subprocessor or service provider | Purpose of processing | Primary processing location |
|---|---|---|
| Stripe, Inc. | Subscription management, payment processing, invoicing, fraud prevention, and billing support. Stripe may act as a processor or an independent controller depending on the processing activity. | United States and other locations used to provide Stripe services |
| Resend, Inc. | Transactional email delivery for account, authentication, billing, and operational messages. Email addresses and message delivery metadata are processed for this purpose. | United States |
| Vercel Inc. | Hosting and delivery of the public HyperMemory documentation site. Website request data and infrastructure logs may be processed; Vercel does not host the core HyperMemory application or customer memory graphs. | Global edge network; United States |
| Google LLC | Google Workspace email, controlled governance documents, audit evidence, and approved business records; optional Google Analytics on the marketing site after opt-in consent. | Global provider infrastructure under the selected service and account terms |
| ClickUp, Inc. | Support-ticket and internal work-management records. Customer memory content and files are prohibited from support tickets. | United States and other provider locations |
| Intuit Inc. | QuickBooks accounting, transaction reconciliation, tax, and financial records. It does not store customer memory content. | United States and other provider locations |
Scope of this list
This register covers third parties evidenced in the current production and approved business architecture that may receive personal data while providing HyperMemory, its support functions, or its public websites. Self-hosted components operated on HyperMemory-controlled infrastructure—such as SurrealDB, Qdrant, Redis, and the local embedding service—are not separate subprocessors. GitHub is used for source control and Vercel for public websites; neither hosts the core application database or customer memory graphs.
The individual model providers available through OpenRouter are downstream providers. The approved model-provider mapping, applicable retention settings, transfer safeguards, and service-specific configuration are controlled materials.
Changes to subprocessors
HyperMemory reviews this page when a provider is added, replaced, or materially changes its processing role. The Last updated date reflects the most recent public review. For enterprise customers, HyperMemory provides at least 30 days’ advance notice of a new or replacement subprocessor and provides objection and termination rights under the applicable customer agreement or Data Processing Addendum. Other contractual notice rights and transfer terms remain governed by the applicable agreement.
Provider privacy resources
- Hetzner data protection information
- Supabase Data Processing Addendum
- OpenRouter privacy policy
- Unstructured subprocessor list
- Brave Search API privacy notice
- Bright Data privacy policy
- Stripe Data Processing Agreement
- Resend Data Processing Addendum
- Vercel Data Processing Addendum
- Google Workspace privacy and trust
- ClickUp security
- Intuit privacy statement