Subprocessors
The named service providers HarmonyWFM uses to run the platform. We notify customers before adding a new one.
Last updated: August 16, 2026
Current subprocessors
Primary customer data — employee records, punches, timesheets, documents — is stored in Canada (AWS ca-central-1). Other providers process only the limited data described below.
| Service | Purpose | Data processed | Processing location |
|---|---|---|---|
| Lovable (application hosting, CDN & AI Gateway) | Serves the web application and API traffic; routes AI feature requests | Request metadata, IP address, session tokens, prompt content | Global edge network |
| Supabase (managed Postgres, authentication & file storage) | Stores workspace records, authenticates users, holds uploaded files | All customer workforce data, credentials, uploaded documents and receipts | AWS ca-central-1 (Canada) |
| Resend (transactional email delivery) | Sends approvals, invitations, notifications, and invoices | Recipient name and email address, message content and attachments | United States |
| Google (Gemini models, accessed through the Lovable AI Gateway) | Powers the assistant, quiz generation, and summarization features | Prompt content submitted by the user for that feature | United States |
| LiveKit (real-time video infrastructure) | Audio/video sessions for the Meetings module | Participant name, connection metadata, media streams (not recorded by default) | Global edge network |
Notice of changes
We will notify administrative contacts before a new subprocessor begins processing customer data, so customers can raise a reasonable data-protection objection.
Security documentation
Vendor security documentation and completed questionnaires are available under NDA for procurement review — email admin@harmonywfm.com.