Legal release status: This reference document is not yet effective or available for contractual acceptance.The licensed operator identity has been documented. Operational retention and deletion commitments, provider/AI agreements, international-transfer safeguards and release approval still require verification.
Render — application hosting
Observed Production region: Oregon, United States, on 24 October 2026. Hosts application processing, including data needed for requests. Exact contracting entity, support/backup locations, written agreement and transfer route require verification.
Supabase — database, authentication and storage
Observed Production database region: Frankfurt, Germany. Authentication, storage objects, service logs and support have separate configuration and retention considerations. Exact contracting entity, agreements, onward locations and deletion/backup handling require verification.
Resend — email features
Processes recipient/delivery data and content for enabled outbound or inbound functions. Contracting entity, processing/support locations, contractual terms, retention and transfer mechanism require verification.
OpenAI API — enabled AI features
Workspace Assistant, Research Chat and Gmail classification have different inputs, choices and retention dependencies. Verify contracting entity, applicable agreement, account data-sharing/retention settings and processing/transfer locations. Provider retention and model training are separate matters. Google-derived information remains subject to Limited Use restrictions.
Stripe — billing/payments
Processes billing and payment information. Assess its service role and independent legal/fraud-compliance purposes rather than treating every operation as a subprocessor activity. Contracting entity, agreements, locations and relevant retention require verification.
Google services — customer-authorised integrations
Calendar and Gmail operate under the connected user’s authorisation and the feature choices described in Privacy. Identify the parties’ roles and necessary transfers for the particular activity. Disconnection is not deletion of imported copies or existing Calendar events.
Google Analytics and Microsoft Clarity — optional website analytics
Run only after the disclosed public-site analytics choice on supported marketing routes; Clarity is limited to the homepage. They are excluded from authenticated HR workspace analytics in the reviewed implementation. Verify provider settings, agreements and the relevant controller/processor and international-transfer position.
Register status and changes
This provider register identifies services and data-processing functions known to HR Copilot. The supplier diligence, written data-protection obligations, onward-processing and transfer routes noted in the individual entries remain subject to verification; the register is not proof of approved cross-border transfers. Customers can request additional information or raise substantiated concerns via info@sinartech.ae before relevant changes.