Sub-processors
Annex 3 of the Data Processing Agreement (version 2026-10-v1), kept current here. بالعربية
At least 30 days before we add or replace a sub-processor, we email each customer's account owner and update this page; the customer may object (DPA clause 7.3). "Not yet stated" means we have not yet established the processing location from that provider's terms; we add it here when we have.
Core sub-processors (used for every customer)
Convex and Cloudflare are the platform itself. The others are called by the product for every customer.
| Service | Purpose | Data categories | Processing location |
|---|---|---|---|
| Convex, Inc. | Database, server logic, file storage | all categories in DPA Annex 1 | Outside the GCC (a Convex cloud region on Amazon Web Services) |
| Cloudflare, Inc. | Web delivery, network security | data in transit; request metadata | Cloudflare's global network |
| Anthropic, PBC | AI assistant and AI document reading | identity, financial, health | Not yet stated |
| Resend | Transactional email | identity, financial | Not yet stated |
| Meta Platforms (WhatsApp Business / Cloud API) | Messaging and notifications | identity, financial | Not yet stated |
Optional — only when the customer turns the feature on
These receive data only after a customer enables the integration or feature (DPA clause 7.4).
| Service | Purpose | Data categories | Processing location |
|---|---|---|---|
| OpenAI | AI assistant and AI document reading | identity, financial, health | Not yet stated |
| Stripe | Payments | identity, financial | Not yet stated |
| Moyasar | Payments | identity, financial | Not yet stated |
| Lean Technologies | Payments | identity, financial | Not yet stated |
| Mudad | Government filing (Saudi platforms) | identity, government ID, financial | Saudi Arabia |
| Qiwa | Government filing (Saudi platforms) | identity, government ID | Saudi Arabia |
| Nitaqat | Government filing (Saudi platforms) | identity, special category | Saudi Arabia |
| Google Identity | Sign-in and directory sync | identity | Not yet stated |
| Google Workspace | Sign-in and directory sync | identity | Not yet stated |
| Google APIs | Sign-in and directory sync | identity | Not yet stated |
| Zoho | Accounting sync | identity, financial | Not yet stated |
| Xero | Accounting sync | identity, financial | Not yet stated |
| Qoyod | Accounting sync | identity, financial | Not yet stated |
| Sage | Accounting sync | identity, financial | Not yet stated |
| SAP | Accounting sync | identity, financial | Not yet stated |
| Wafeq | Accounting sync | financial | Not yet stated |
| QuickBooks (Intuit) | Accounting sync | identity, financial | Not yet stated |
| Zoho Books | Accounting sync | identity, financial | Not yet stated |
| Slack | Approver messages from the Slack app (leave and expense approvals) | identity, financial, health | Not yet stated |
| Microsoft Graph (Microsoft 365 / SharePoint) | Document storage / directory | identity | Not yet stated |
Not sub-processors for customer employee data
These process Ahlan Hamad's own sales and advertising data (prospects, and hashed contact identifiers for advertising measurement). They receive no data about a customer's employees and are covered by the Privacy Policy, not the DPA.
| Service | Purpose | Data categories |
|---|---|---|
| Clay | Ahlan Hamad's own sales and advertising measurement | identity |
| Apollo | Ahlan Hamad's own sales and advertising measurement | identity |
| HubSpot | Ahlan Hamad's own sales and advertising measurement | identity |
| Instantly | Ahlan Hamad's own sales and advertising measurement | identity |
| Ahlan Hamad's own sales and advertising measurement | identity | |
| Google Ads | Ahlan Hamad's own sales and advertising measurement | identity |
Ahlan Hamad's own first-party error reporting also runs, inside the Service itself. Questions: privacy@ahlanhamad.com