Subprocessors
Hyparam Corporation uses the providers below to run HypAware Cloud and this website. “Cloud” rows handle data your organization syncs. “Website” rows handle data about visitors to hypaware.ai. Dashboard rows cover visits to app.hypaware.ai.
| Provider | Applies to | Purpose | Data it receives | Location |
|---|---|---|---|---|
| Amazon Web Services | Cloud | Hosting (EC2, EBS volume and snapshots), content delivery and TLS (CloudFront) | All synced data, reports, audit records, report generation transcripts, and Ask conversation transcripts (Ask is the question box in the dashboard). CloudFront sees your IP address | United States (Oregon, us-west-2) |
| Anthropic | Cloud | Report generation and Ask | Query results over your organization’s synced sessions, as stored after collector-side masking, without additional server-side redaction. Can include prompts, responses, tool arguments, paths, git remotes, and account identifiers. For Ask, also the member’s question, email address, host names and current dashboard page, and the conversation history | United States |
| Cloud | Sign-in (OpenID Connect) | Your sign-in at Google. Google returns your verified email and account identifier to us | Global | |
| GitHub | Cloud | Repository activity backfill, run by a Hyparam operator for configured repositories | The names of the repositories requested. Data flows from GitHub to us: issues, pull requests, reviews, commits, file paths, actor logins | United States |
| Amazon Web Services | Website | Hosting (S3, CloudFront) | Your IP address and the pages you request | United States (us-east-1) |
| PostHog | Website | Analytics and, after you accept, session replay | Page views, clicks with element text, and seven named events. After Accept: cookie IDs and replay with typed input masked | United States (US Cloud) |
| PostHog | Dashboard | Page view, page leave, and click analytics, the sign-in event, the feedback event, and server-side product events | Page URLs, clicks (element type and position, and a fixed control name for some buttons; never element text), IP address, browser and device information, and visitor and session IDs. Your account identifier, email, role, and organization when you are signed in and analytics is allowed. Cookie and browser storage IDs are used after Accept, or where consent is not required unless you decline. The sign_in_completed event: sign-in method and whether it is the first sign-in. The feedback event, sent when you answer a feedback question on a report or recommendation: your answer (yes or no) when you click it, any comment you write and send, as you wrote it, and which report or recommendation page it was about. Server-side product events: account identifier, organization, sign-in method and whether the first sign-in created the organization, report and recommendation IDs, enrollment method, HypAware version, OS family, configured client names, session and day counts from a host’s first hour of sync, and recommendation count per report; never session content, prompts, responses, file paths, repository names, hostnames, report or recommendation text, or emails. A host is any machine the collector runs on: a laptop, a build box, a remote agent’s box. | United States (US Cloud) |
| Amazon Web Services | Cloud | Product and service email (Amazon SES) | Your email address and the content of each email we send you. SES also keeps addresses that unsubscribe, bounce, or mark an email as spam | United States |
| Slack | Cloud | Daily internal alerts when an organization’s onboarding stalls or reaches a milestone | Organization identifier, email domain, a count of new members, and which milestones it reached; never emails, names, or session content | United States |
| Clarify | Website | CRM for contact forms | Name, email, company, company size, message, page address, time | United States |
| Clarify | Cloud | CRM record when a person first signs in to an organization or first connects a client | Name, email, organization name, sign-up date | United States |
| Website | Ad click and conversion measurement (Google Ads). No remarketing or ad personalization | IP address, browser information, page address, ad click identifier, and Google cookie IDs. Only after Accept, or by default where consent is not required; never when the browser sends Global Privacy Control | United States |
The HypAware CLI is not on this list because it sends your recordings to no one unless you connect it to an organization. It does contact the npm registry about once a day to check for updates, and it forwards your AI client’s traffic to the AI provider that client already uses. If you turn on a connected tool, such as GitHub or Linear, or an AI client whose conversations are kept on the vendor’s service, such as Codex Cloud or Cursor Cloud agents, the CLI also reads from that service’s API with your own sign-in or key. Those requests go from your host to that service, not through us.
We give organization admins 30 days’ notice by email before adding a provider that handles synced data. If you object on data protection grounds, tell us within that window and we will work it through with you; if we cannot, you can end your use of HypAware Cloud.
Version hypaware-2026-11-09.2. Updated November 9, 2026.