Version 2026-11-01. Effective 1 November 2026.
1. About this list
1.1. These service providers help JTL Advisory and Business Solutions Inc. ("JTL") run Sahora. Each processes data only to provide its service to us, under its agreement and data processing terms with us.
1.2. A provider marked planned is not processing Sahora data yet. Before it is switched on, it is listed here as in use and clients are told at least 30 days ahead, as the Data Processing Agreement (section 6) requires.
1.3. Main storage location: Singapore.
2. Providers in use
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, sign-in (including two-step verification) and file storage (employee documents, clock-in selfies, receipts, signatures) | All client data and account data; the sign-in service's security logs, including internet addresses | Singapore (AWS ap-southeast-1); support staff may access it from other countries |
| Vercel (Vercel Inc., United States) | Hosting of the website and the application; runs the application's server code; provides the approximate place (city, province or region, country) of visitors and devices from the internet address | All data passing between users and Sahora, in transit; request logs (address, page, browser and time), kept for a short period by plan | Application code runs in Singapore (sin1); requests pass through Vercel's global network; Vercel may process service data in the United States |
| Cloudflare (Turnstile; Cloudflare, Inc., United States) | Checks that a person, not a program, sends the website's sign-up and contact forms | Technical signals from the visitor's browser (such as internet address and browser details), and the internet address sent with the check | Cloudflare's global network |
3. Providers planned (listed as in use once switched on)
| Provider | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc., United States) | Sending Sahora's emails (invitations, password links, notifications, payslip notices with a link, billing notices, contact form messages) | Recipient's name and email address, and the email's content. Payslip emails never carry the payslip or any amount | Sending region Tokyo, Japan (ap-northeast-1); account data in the United States |
Planned |
| Cloudflare R2 (Cloudflare, Inc., United States) | Off-site backups | A nightly copy of the database and of stored files, encrypted before upload (the database with a key only JTL holds; files with a separate passphrase) | Asia-Pacific location preference (Cloudflare treats it as best effort, not a guarantee) | Planned: the backup job skips until it is set up |
| GitHub (GitHub Actions; GitHub, Inc., United States) | Runs the nightly backup job | The database copy passes through the job's temporary machine, where it is encrypted and then removed. GitHub keeps no copy of the data, but holds the job's settings, including the passphrase for the file backups | Microsoft Azure data centers chosen by GitHub | Planned, with the backups |
| Sentry (Functional Software, Inc., United States) | Error monitoring | Error reports with salary, government ID, bank, name and other personal data fields removed before they leave Sahora; internet addresses not stored | European Union (Frankfurt) for error reports; account information in the United States | Planned: off until set up |
| Google Workspace (Google Asia Pacific Pte. Ltd., Singapore) | Team mailboxes on sahora.ph (support@sahora.ph and mail@sahora.ph) | The content of emails people send to us | Google's data centers | Planned: mailboxes not live yet |
4. Not subprocessors
4.1. Face matching: off. Sahora's software includes an optional face-matching check. It runs only if a client turns it on and an employee agrees in person, and then on a program JTL runs itself, not by a face-recognition company. It is not running today. If it is ever run on a hosted machine, that hosting provider will be listed here first.
4.2. Clock-in movement check: runs on the employee's phone with files served from Sahora itself. No outside company receives the images.
4.3. Website analytics: Sahora counts visits itself, without cookies. If a web analytics service (such as Vercel Web Analytics) is added, it will be listed here first.
4.4. Map services: when a client's HR or supervisor opens a punch location on a map, the location goes to the map service they choose (Google Maps or OpenStreetMap), under that service's terms.
4.5. Banks, government agencies and accounting software: files that a client downloads from Sahora and uploads elsewhere are sent by the client, not by Sahora. Data a client sends to its own systems through the API or webhooks goes where the client sets it up.
5. Contact
Questions about this list: support@sahora.ph.