Sub-processors

1. What this list is

A sub-processor is a company that MYLABS AI Solutions engages to process personal data while providing ClearHours. This page is the published form of Annex B of our data processing agreement: when you accept the agreement you authorise the providers listed here.

We pass on to each provider obligations that protect your data at least as well as the agreement does, and we remain responsible to you for what they do (clause 9.2).

2. Current sub-processors

As of 8 October 2026:

• Microsoft Azure

  Customer data

  Microsoft

  What it does

  Hosts the ClearHours service: application servers, the database, file storage for activity records, key management and service monitoring.

  Data it receives

  All customer data held in the service: activity records, attendance, timesheets, projects, users and the audit log.

  Where

  India: Azure Central India (Pune). Database backups stay in the same region.

• Microsoft Azure Static Web Apps

  Website and dashboard files

  Microsoft

  What it does

  Serves this website and the static files of the ClearHours dashboard (pages, scripts, fonts and images).

  Data it receives

  No customer data. Like any web server it receives the visitor’s IP address and request details in order to deliver the files.

  Where

  East Asia region, delivered through Microsoft’s global network.

• Stripe

  Billing data

  Stripe India Private Limited

  What it does

  Takes card payments for subscriptions: the hosted checkout page, renewals, payment receipts and the billing portal.

  Data it receives

  Billing contact data only: organisation name, billing e-mail and address, GSTIN, plan and seat count. Card details are typed on Stripe’s own page and never reach ClearHours. No employee data.

  Where

  India for Indian payment transactions. Stripe affiliates outside India may process data, depending on the service and the payer’s location.

• Resend

  E-mail delivery

  Transactional e-mail

  What it does

  Delivers ClearHours e-mail: sign-up verification, invitations, timesheet notices, daily digests and grievance responses.

  Data it receives

  The recipient’s e-mail address and name, and the message. A message can name work items or carry a written response to a grievance. No activity data is ever sent by e-mail.

  Where

  Outside India, on Resend’s mail infrastructure.

Stripe receives billing data for which MYLABS is itself responsible, never your employees’ data. It is listed here so that every company that receives data in connection with ClearHours is in one place. Our privacy policy describes that data.

3. Where customer data is kept

Customer data in the service (activity records, attendance, timesheets, projects, users and the audit log) is stored and processed in Microsoft Azure Central India, in Pune. Database backups stay in the same region.

Three kinds of processing happen outside that region, and the list above says what each one carries:

• the files of this website and of the dashboard, served from Azure Static Web Apps, which hold no customer data;
• billing contact data sent to Stripe for card payments;
• the e-mail the service sends, delivered by Resend, which carries the recipient’s address and name and the message, but never activity data.

4. Providers not yet engaged

Two features rely on providers we have not engaged yet: single sign-on (on the Enterprise plan) and the AI assistant for employees, which is a preview. Before either provider processes any customer data, we will add it to this list with the 30 days’ notice described below.

5. Services you connect yourself

Some features send data to a destination you choose. Those destinations are yours, not our sub-processors, and you decide what they receive:

• webhook endpoints and integrations that use your API keys;
• the collector you stream your audit log to, on the Enterprise plan;
• your identity provider, when you set up single sign-on and SCIM provisioning on the Enterprise plan;
• the payroll, timesheet and report files you export and download.

6. Changes and notice

Change log

• 8 October 2026: First published list: Microsoft Azure, Microsoft Azure Static Web Apps, Stripe and Resend.

7. Questions

If your organisation needs more detail about a provider, for a vendor review or a data protection impact assessment, ask us.

Write to us at support@clearhours.app.