Sub-processor List
Hemera Intelligence Limited · Last updated: 6 July 2026 · Version 1.1
Sub-processors
The following third-party sub-processors are engaged by Hemera Intelligence Limited in the provision of the HemeraScope service. Each sub-processor processes data only for the purposes described below.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication & user management | User email, name, session data | US (SOC 2 Type II) |
| Vercel, Inc. | Frontend hosting & CDN | Session cookies, page requests | Global (US-headquartered) |
| Render, Inc. | Backend application hosting | All application data in transit through the API | US (Oregon) |
| Neon, Inc. | Managed Postgres database | All application data at rest | US |
| Amazon Web Services (S3) | Evidence file storage | Uploaded evidence documents (invoices, bills, supporting files) | EU (Ireland) |
| Stripe, Inc. | Payment processing | Billing name, email, payment card details (card numbers are held by Stripe, never by us) | US |
| Anthropic, PBC | AI analysis (classification, risk) | Transaction descriptions, supplier names | US |
| Xero Limited | Accounting data import, where you choose to connect your Xero organisation | Read-only access to bills, invoices, contacts and chart-of-accounts settings for the organisation you connect | US / NZ |
| OpenSanctions | Sanctions and politically-exposed-person screening of suppliers | Supplier, company and director names, sent as lookup queries | EU |
| postcodes.io | UK postcode geocoding for travel and site distance calculations | UK postcodes, sent as lookup queries | UK |
| Resend | Transactional & notification email | Recipient name, email address, message content | US |
| Sentry | Error monitoring & diagnostics | Diagnostic data, which may include user identifiers | US |
| Google LLC (Gmail) | Correspondence inbox: enquiries, support, and data subject rights requests sent to our published contact address | Sender name, email address, message content and any attachments the sender chooses to include | US / global |
Public registries and datasets that HemeraScope reads from, including Companies House, the Environment Agency, the Health and Safety Executive, SBTi and CDP, are data sources, not sub-processors. To resolve a supplier we send its supplier or company name to these registries as a search or lookup query; we do not send them your wider Client Data.
Changes to this list
This list was last updated 29 July 2026. We will notify clients of changes to this list at least 30 days before adding a new sub-processor, in line with our Data Processing Agreement.
If you have questions about our sub-processors, please contact us at hemerascope@gmail.com.