Skip to content
Clox

Legal

Sub-processors

Effective June 27, 2026

To provide Clox, the time-tracking and workforce-management service operated by Clox Labs LLC, a Wyoming limited liability company ("Clox", "we", "us", or "our"), we rely on a small set of trusted third-party providers that process personal data on our behalf. This page is the current, maintained list of those sub-processors. For each one we describe its purpose, the categories of data it may process, and its primary region. We keep this page up to date as our providers change.

This page is informational and is not legal advice. It describes the providers Clox currently uses and is read together with our Data Processing Agreement and Privacy Policy, which govern how personal data is handled.

1. Supabase

Supabase provides our database hosting and authentication. It is where your account and workforce records are stored and where sign-in is handled.

  • Purpose: Database hosting and authentication.
  • Categories of data: Account and workforce data, including identifiers, employment details, and time records.
  • Primary region: United States.

2. Vercel

Vercel hosts and serves the Clox web application and delivers it through its content delivery network.

  • Purpose: Application hosting and content delivery (CDN).
  • Categories of data: Request and application data passing through the Service.
  • Primary region: United States, with a global edge network.

3. Stripe

Stripe processes subscription payments. Card details are entered directly with Stripe and are not stored by Clox.

  • Purpose: Payment processing.
  • Categories of data: Billing and payment data, including the billing contact and payment-method details held by Stripe.
  • Primary region: United States, with global processing.

4. PostHog

PostHog provides product analytics that help us understand how the Service is used and where to improve it.

  • Purpose: Product analytics.
  • Categories of data: Usage and event data, such as feature interactions and pages viewed.
  • Primary region: United States.

5. Resend

Resend delivers our transactional email, such as invitations, password resets, and account notifications.

  • Purpose: Transactional email delivery.
  • Categories of data: Names and email addresses of recipients.
  • Primary region: United States.

6. Apple TestFlight and App Store

Apple distributes the Clox mobile employee app and delivers push notifications for the current beta program.

  • Purpose: Mobile app distribution and push notifications for the beta.
  • Categories of data: Device and account identifiers used for distribution and notification delivery.
  • Primary region: United States.

7. Sentry

Sentry provides application error and performance monitoring that helps us detect, diagnose, and fix problems in the Service.

  • Purpose: Error and performance monitoring.
  • Categories of data: Diagnostic data that may include user and organization identifiers, request metadata, and error details.
  • Primary region: United States.

8. Upstash

Upstash provides a Redis datastore that powers rate limiting and abuse prevention across the Service.

  • Purpose: Rate limiting and abuse prevention.
  • Categories of data: Short-lived counters keyed to identifiers such as IP address, email, and account or device identifiers.
  • Primary region: United States.

9. OpenStreetMap Foundation

The OpenStreetMap Foundation provides map tiles and address lookup used when a manager sets up a worksite. These requests are made directly from the manager's browser rather than from our servers, which exposes the browser's IP address and the address terms typed into the search.

  • Purpose: Map tiles and address lookup for worksite setup.
  • Categories of data: Browser IP address and the address terms typed into the worksite search.
  • Primary region: United Kingdom, with global delivery.

Changes to this list

We will give customers at least 30 days of notice before we add or replace a sub-processor, and customers may object to a new sub-processor as described in our Data Processing Agreement. If we cannot resolve a reasonable objection, the customer may end the affected part of the Service in line with the terms there.

For more detail, see our Data Processing Agreement and our Privacy Policy.