Legal

Sub-processors

Last updated 27 August 2026

TimeGate uses a small number of third-party providers to run the platform. This page lists each one, what it is used for, and the region it processes data in. It is referenced by our privacy policy and our data processing agreement.

We keep this list short on purpose. Every provider added here is another party with access to customer data.

Infrastructure

These providers process customer personal data.

  • Amazon Web Services. Application hosting and the production database. United States.
  • Amazon S3, part of Amazon Web Services. Storage of uploaded files, including leave request attachments. US East (N. Virginia).
  • Upstash. Managed Redis used for caching and rate limiting. Cache entries can contain personal data for short periods.
  • Email delivery provider. Transactional email such as account invitations and password resets, sent over SMTP. This entry is being updated to name the current provider; ask us at hello@timegate.me if you need it confirmed before signing.

Non-production and website

These do not process production customer data.

  • Render. Hosting for the staging environment, which uses a separate database and contains test data rather than production customer data.
  • Vercel. Hosting for the timegate.me marketing website. The website does not have access to platform data.

Analytics on the website

The marketing website uses Vercel Analytics and Vercel Speed Insights to count page views and measure loading performance. These run only on timegate.me, not in the product, and are not connected to any employee record.

What is not here

We do not use an advertising network, a customer data platform, or a third-party session recording tool.

One-time codes for mobile sign-in are issued through the dashboard by your HR team rather than through an SMS gateway, so no SMS provider is involved.

We do not send data to a third-party AI or machine learning service.

Changes to this list

We give at least 30 days notice to account contacts before adding or replacing a sub-processor that handles customer personal data. Customers may object on reasonable data protection grounds, as set out in section 5 of the data processing agreement.

To be added to the notification list, email hello@timegate.me.