Humareso, LLC Last Updated: October 14, 2026 Effective Date: September 2, 2026
Introduction
Humareso, LLC ("Humareso") provides HR platforms and HR outsourcing (HRO) services to client organizations. In delivering these services, Humareso acts as a data processor on behalf of its clients. To operate the platform and fulfill service obligations, Humareso engages certain third-party vendors that may process personal data. These vendors are referred to as sub-processors.
Humareso is responsible for ensuring that each sub-processor provides sufficient guarantees regarding data protection and that sub-processor engagements comply with applicable privacy law, including the EU General Data Protection Regulation (GDPR) where applicable. Humareso enters into data processing agreements with sub-processors and conducts periodic reviews of their data handling practices.
This list is maintained and updated as sub-processor relationships change. Humareso will provide at least 30 days' advance notice of any material changes to this list, including additions, replacements, or removals of sub-processors, except where an immediate change is required for security, legal compliance, or operational continuity. Notice will be provided by updating this page and, where required by the applicable service agreement, by direct notification to affected clients.
Receiving notice of changes
Client organizations are entitled to advance written notice of any addition, replacement, or removal of a sub-processor, and to object to a new or replacement sub-processor on reasonable data protection grounds within 14 days of that notice. Where a Data Processing Agreement is in place, these are the rights set out in its sections 7.2 and 7.3.
To receive these notices, subscribe at humareso.com/security. The address you enter is added to the sub-processor notice list and is used for nothing else. To have notices sent to a named person at your organization instead, or to change or remove an address already on the list, write to DPO@humareso.com.
This page is updated whenever the list changes, and every change is recorded in the change log at the end of it, so it can also be checked directly at any time.
Questions about this list may be directed to DPO@humareso.com.
Sub-Processors
Microsoft Corporation
Purpose: Business productivity and communication platform. Humareso's primary business email runs on Microsoft 365 Exchange Online. All client-facing email communications --- including HRO service delivery, leave case correspondence, platform support, onboarding, and general account communications --- are routed through Microsoft. SharePoint and OneDrive are used for document storage and collaboration. Teams is used for internal communications. Personal data contained in email correspondence (including employee names, case references, and HR matters discussed with client contacts) passes through Microsoft infrastructure.
Data categories received: Business contact information; email correspondence with clients and client personnel, which may reference employee names, leave case details, HR matters, and other personal data discussed in the course of service delivery; documents shared via SharePoint or OneDrive in connection with client engagements. Microsoft 365 does not directly access Humareso's platform databases (Engage, Leave, and Portal data is stored in AWS, Heroku, and Vercel infrastructure).
Platforms: All services --- email is used across HRO, Engage, Leave, Portal, and all client communications.
Location: United States (global infrastructure)
Privacy policy: https://privacy.microsoft.com/en-us/privacystatement
HubSpot, Inc.
Purpose: CRM, client service desk, marketing, and subscription management. HubSpot Service Hub operates Humareso's client help desk: support tickets, shared client HR inboxes, and related correspondence with client personnel are managed as HubSpot conversations. Portal reads and writes client tickets, projects, and document references through HubSpot. Verify records employment-verification requests. Fax records inbound fax events and their association to leave cases as ticket metadata; the fax documents themselves are stored in AWS, not HubSpot. Marketing site forms and Hub subscription management also run on HubSpot.
Data categories received: Business contact information; support ticket and help desk correspondence with clients and client personnel, which may reference employee names, leave case references, and HR matters discussed in the course of service delivery; employment-verification request records; marketing engagement events; Hub subscription data. Does not receive leave clinical documentation (fax documents, medical certifications, or provider details), compensation data, or platform database records. The HubSpot sensitive data capability is enabled on Humareso's account.
Platforms: Portal, Leave (case references in service correspondence), Verify, Fax (event metadata), Hub, marketing site (humareso.com)
Location: United States
Privacy policy: https://legal.hubspot.com/privacy-policy
HubSpot Commerce (HubSpot, Inc.)
Purpose: Subscription billing for the Hub platform.
Data categories received: Billing information, subscription status.
Platforms: Hub
Location: United States
Privacy policy: https://legal.hubspot.com/privacy-policy
Amazon Web Services (AWS)
Purpose: Cloud infrastructure; encrypted database, document, and media storage. Primary database store for Engage, Auth, and Agent. For Leave, AWS provides encrypted document and attachment storage (S3); the Leave application database is hosted by Neon (see below).
Data categories received: All platform data in encrypted form.
Platforms: Engage, Portal, Leave, Auth, Agent, Fax, Events
Location: United States
Privacy policy: https://aws.amazon.com/privacy/
Vercel, Inc.
Purpose: Frontend hosting and CDN for all Next.js-based platforms.
Data categories received: Application request data, edge network logs.
Platforms: Engage App, Admin, Portal, Leave, Hub, Auth, Handbook, Verify, Website, Fax
Location: United States (global CDN)
Privacy policy: https://vercel.com/legal/privacy-policy
Heroku (Salesforce, Inc.)
Purpose: Backend application hosting.
Data categories received: Application request data, server-side logs.
Platforms: Engage API, Agent
Location: United States
Privacy policy: https://www.salesforce.com/company/privacy/
Sentry (Functional Software, Inc.)
Purpose: Application error monitoring and logging.
Data categories received: Error stack traces, user session identifiers, platform event logs. Does not receive leave health data, ADA accommodation data, EEO or protected class data, or compensation data.
Platforms: Engage, Admin, Portal, Leave, Hub, Auth, Agent, Fax, Notify, Handbook, Verify
Location: United States
Privacy policy: https://sentry.io/privacy/
Mailgun (Sinch)
Purpose: Transactional email delivery.
Data categories received: Email address and email content for delivery. Does not receive employee records.
Platforms: Engage, Portal, Leave, Agent
Location: United States
Privacy policy: https://www.mailgun.com/privacy-policy/
Twilio Inc.
Purpose: SMS and voice communication delivery for the Agent service.
Data categories received: Phone numbers, message content for HR case communications delivered via SMS or voice.
Platforms: Agent
Location: United States
Privacy policy: https://www.twilio.com/en-us/legal/privacy
Telnyx LLC
Purpose: Fax transmission for HR document delivery.
Data categories received: Fax content transmitted via the Fax service, which may include leave certifications, HR documents, and related sensitive records.
Platforms: Fax
Location: United States
Privacy policy: https://telnyx.com/privacy-policy
Anthropic, PBC
Purpose: AI model provider. Claude assists human administrators across Humareso platforms with drafting, summarization, and analytical tasks in HR workflows, including leave eligibility determinations, case communications, performance summaries, and related HR functions. Humareso transmits only the structured data fields necessary for each specific task. Raw medical documents, uploaded files, and unstructured health records are not transmitted. Anthropic does not retain or use API-submitted data for model training. Humareso may engage successor or alternative AI providers in accordance with the applicable Data Processing Agreement and Sub-Processor notification obligations.
Data categories received: Structured HR data relevant to the specific task requested, which may include employment identifiers (name, job title, department, work state, tenure, employment status); leave case data (case type, reason, dates, hours worked, FTE, employer headcount, program eligibility); performance data (ratings, written feedback text, goal status, behavioral scores); and case or communication context. Raw documents, medical certifications, uploaded files, and unstructured health records are never transmitted.
Platforms: Leave, Engage (including Perform and other AI-assisted features), Portal, and other Humareso platforms where AI-assisted features are enabled.
Location: United States
Privacy policy: https://www.anthropic.com/privacy
Neon, Inc.
Purpose: Database hosting (PostgreSQL) for Hub, Handbook, and Leave.
Data categories received: Hub subscriber data, content data, and Handbook data. For Leave, the application database hosted by Neon contains leave case data (case type, reason, dates, hours worked, FTE, employer headcount, program eligibility), employment identifiers (name, job title, department, work state, tenure, employment status), case communications, and related FMLA and leave-of-absence records, which may include health-related information. Raw uploaded documents and medical certifications are not stored in Neon; those remain in encrypted AWS S3 storage.
Platforms: Hub, Handbook, Leave
Location: United States
Privacy policy: https://neon.tech/privacy-policy
Google Analytics (Google LLC)
Purpose: Website usage analytics. Not used within authenticated platforms.
Data categories received: Anonymized IP address, device type, page views.
Platforms: Marketing site (humareso.com) only
Location: United States (global infrastructure)
Privacy policy: https://policies.google.com/privacy
Google Tag Manager (Google LLC)
Purpose: Tag and tracking script management on the marketing website.
Data categories received: Operates as a tag container; data collected depends on tags deployed.
Platforms: Marketing site (humareso.com) only
Location: United States (global infrastructure)
Privacy policy: https://policies.google.com/privacy
Meta Platforms, Inc. (Facebook Pixel)
Purpose: Advertising effectiveness measurement on the marketing website.
Data categories received: Hashed email address (if provided by visitor), IP address, browser type, engagement events.
Note: This activity may constitute a "sale" or "sharing" of personal information under the California Consumer Privacy Act (CCPA). California residents may opt out via the "Do Not Sell or Share My Personal Information" link on humareso.com.
Platforms: Marketing site (humareso.com) only
Location: United States
Privacy policy: https://www.facebook.com/privacy/policy/
AI Governance and Data Minimization
Humareso applies data minimization principles to AI-assisted processing workflows. Across the Humareso platforms, the data transmitted to an AI sub-processor is limited to structured fields and text reasonably necessary for the requested task. AI-generated outputs are reviewed by human administrators before being communicated or applied within employment-related workflows.
Disclosed exception: inbound document classification. Humareso's fax intake service transmits the inbound document itself, in full, to its AI sub-processor in order to identify the document type and route it to the correct leave case. Documents received on this path may include medical certifications and other clinical documentation. This transmission is covered by the business associate agreement described below. No other Humareso platform transmits uploaded files, document images, or unstructured attachments to an AI sub-processor.
Note on AI processing. Anthropic is Humareso's only AI sub-processor. Anthropic does not use data submitted via its API to train or improve its AI models. This applies to everything any Humareso platform transmits when generating AI-assisted drafts, classifications, or outputs, including the document transmission disclosed above. Humareso executed a business associate agreement with Anthropic on October 12, 2026, and Humareso's account operates under Anthropic's HIPAA configuration.
Client-Configured Integrations
Humareso's HRO service agreements allow client organizations to authorize connections to their own HRIS, payroll, and benefits administration platforms (such as ADP, Paylocity, Gusto, Rippling, and similar providers). These integrations are configured at the direction of the client and governed by the client's own agreements with those vendors.
Client-configured integrations are not Humareso sub-processors. Data shared with those platforms flows pursuant to the client's authorization and is subject to the client's own data sharing agreements and privacy obligations. A current list of active integrations for a specific client account is available upon request by contacting DPO@humareso.com.
Contact
For questions about this sub-processor list, data processing practices, or to exercise applicable data rights, contact:
Data Protection Officer Humareso, LLC DPO@humareso.com
Change Log
Version 1.3 --- October 14, 2026 Two changes. A "Receiving notice of changes" section was added, setting out the advance-notice and 14-day objection rights and how a client subscribes to receive those notices. The AI Governance section was corrected: the prior wording stated that uploaded files, raw medical records, and unstructured attachments were excluded from transmission to AI sub-processors, which was inaccurate, because Humareso's fax intake service transmits the inbound document in full for classification and routing and documents on that path may include medical certifications. That exception is now disclosed expressly, the no-training commitment is stated to cover it, and the business associate agreement executed with Anthropic on October 12, 2026 is recorded. No other platform transmits documents, no change was made to what any platform transmits, and no sub-processor was added, replaced, or removed in this version.
Version 1.2 --- September 2, 2026 HubSpot entry rewritten to disclose Service Hub client service desk usage (support tickets, shared client HR inboxes, correspondence that may reference employee names and leave case matters), with the exclusions that apply. Privacy Policy aligned in the same update.
Version 1.1 --- June 29, 2026 Expanded Neon, Inc. scope to include the Leave platform application database (PostgreSQL migration from AWS RDS to Neon). AWS continues to provide encrypted document and attachment storage for Leave.
Version 1.0 --- May 29, 2026 Initial publication of the Humareso sub-processor list.