Shiftray Sub-processor List
Last reviewed: 30 September 2026
These providers support the hosted Shiftray service. The exact configuration and transfer safeguards must be confirmed in each signed client agreement before live employee data is added.
| Provider | Service | Information involved |
|---|---|---|
| Supabase, Inc. | Managed database, authentication, storage and server functions | User accounts, memberships, rota data, announcements, uploaded files and attendance records. |
| Netlify, Inc. | Website hosting, content delivery, TLS and security logs | App files, IP address, device/browser requests and delivery/security logs. Client database records are not intentionally stored in the static site deployment. |
| Resend, Inc. | Transactional authentication email delivery | Recipient email address, delivery metadata and authentication email content. |
Location and transfers
Provider infrastructure and support may involve the UK, EEA, United States and other documented locations. Current provider terms and locations must be checked during client onboarding. For UK restricted transfers, the parties will use the applicable UK transfer mechanism and complete any required risk assessment.
Changes
Clients will receive reasonable advance notice of a new sub-processor where practicable and may raise a reasoned data-protection objection under the signed DPA. Emergency security replacements may require shorter notice.