Last updated 31 August 2026
Hashoff processes employee data on behalf of the companies that install it. Where we rely on another company to do part of that processing, they are a sub-processor, and they are listed here. The list is deliberately short: the fewer companies that touch leave records, the fewer places they can leak from.
| Company | What they do for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts the server and the database. This is where leave records, people and policies are actually stored. | Helsinki, Finland (EU) |
| Cloudflare, Inc. | DNS for hashoff.app, and routing for mail sent to our support address. Support email may contain whatever you choose to put in it. | Global network |
Slack is the source of the data rather than a sub-processor of ours: your workspace already has its own relationship with Slack, and Hashoff reads from and writes to it under the permissions your administrator granted at install.
Let's Encrypt issues the certificate that secures hashoff.app. It sees no customer data.
We use no analytics, advertising, tracking, customer-support, or email-marketing provider. There is no payment processor, because Hashoff is free. Nothing you put into Hashoff is used to train a machine-learning model, by us or by anyone else.
All customer data is stored in the European Union, in Helsinki. Encrypted backups are kept for 30 days. They are encrypted before they are written, with a key that is not kept on the server, so someone who obtained the server could not read them.
If we add a sub-processor, we will update this page before the new sub-processor begins processing customer data, and note the date at the top. If you want to be told directly when that happens, write to us at the address below and we will add you to the list of people we notify.
Email [email protected]. If you need a data processing agreement for your own compliance records, ask and we will provide one.