Subprocessors
Hyparam Corporation uses the providers below to run HypAware Cloud and this website. “Cloud” rows handle data your organization syncs. “Website” rows handle data about visitors to hypaware.ai. Dashboard rows cover visits to app.hypaware.ai.
| Provider | Applies to | Purpose | Data it receives | Location |
|---|---|---|---|---|
| Amazon Web Services | Cloud | Hosting (EC2, EBS volume and snapshots), content delivery and TLS (CloudFront) | All synced data, reports, audit records, and report generation transcripts. CloudFront sees your IP address | United States (Oregon, us-west-2) |
| Anthropic | Cloud | Report generation | Query results over your organization’s synced sessions, unredacted. Can include prompts, responses, tool arguments, paths, git remotes, and account identifiers | United States |
| Cloud | Sign-in (OpenID Connect) | Your sign-in at Google. Google returns your verified email and account identifier to us | Global | |
| GitHub | Cloud | Repository activity backfill, run by a Hyparam operator for configured repositories | The names of the repositories requested. Data flows from GitHub to us: issues, pull requests, reviews, commits, file paths, actor logins | United States |
| Amazon Web Services | Website | Hosting (S3, CloudFront) | Your IP address and the pages you request | United States (us-east-1) |
| PostHog | Website | Analytics and, after you accept, session replay | Page views, clicks with element text, and seven named events. After Accept: cookie IDs and replay with typed input masked | United States (US Cloud) |
| PostHog | Dashboard | Page view, page leave, and click analytics, the sign-in event, and server-side product events | Page URLs, clicks (element type and position, and a fixed control name for some buttons; never element text), IP address, browser and device information, and visitor and session IDs. Your account identifier, email, role, and organization when you are signed in and analytics is allowed. Cookie and browser storage IDs are used after Accept, or where consent is not required unless you decline. The sign_in_completed event: sign-in method and whether it is the first sign-in. Server-side product events: account identifier, organization, report and recommendation IDs, enrollment method, HypAware version, OS family, configured client names, session and day counts from a machine’s first hour of sync, and recommendation count per report; never session content, prompts, responses, file paths, repository names, hostnames, report or recommendation text, or emails. | United States (US Cloud) |
| Amazon Web Services | Cloud | Product and service email (Amazon SES) | Your email address and the content of each email we send you. SES also keeps addresses that unsubscribe, bounce, or mark an email as spam | United States |
| Slack | Cloud | Daily internal alert when an organization’s onboarding stalls | Organization identifier and email domain only; never emails, names, or session content | United States |
| Clarify | Website | CRM for contact forms | Name, email, company, company size, message, page address, time | United States |
| Website | Ad click and conversion measurement (Google Ads). No remarketing or ad personalization | IP address, browser information, page address, ad click identifier, and Google cookie IDs. Only after Accept, or by default where consent is not required; never when the browser sends Global Privacy Control | United States |
The HypAware CLI is not on this list because it sends your recordings to no one unless you connect it to an organization. It does contact the npm registry about once a day to check for updates, and it forwards your AI client’s traffic to the AI provider that client already uses.
We give organization admins 30 days’ notice by email before adding a provider that handles synced data. If you object on data protection grounds, tell us within that window and we will work it through with you; if we cannot, you can end your use of HypAware Cloud.
Version hypaware-2026-10-14.2. Updated October 14, 2026.