Subprocessors
Subprocessors
The providers that process customer data on HLT’s behalf to run HLT Cloud. Each is bound by a data processing agreement.
Cloudflare, Inc.
Always used- Services used
- Workers, Static Assets, R2, Queues, Durable Objects, Images, Email Service, Workers Logs, Turnstile
- Purpose
- Website delivery, application runtime, file storage, background jobs, live collaboration, photo processing, PDF rendering, transactional email and diagnostics; spam check for the contact form
- Processing location
- Global network for request processing; files and collaboration rooms in the EU jurisdiction where supported
Neon (a Databricks company)
Always used- Services used
- Serverless PostgreSQL, backups and point-in-time recovery
- Purpose
- Storage of accounts, organizations and audit records
- Processing location
- Frankfurt, Germany (AWS eu-central-1)
OpenRouter, Inc.
Only if your organization enables AI features- Services used
- AI model routing
- Purpose
- Template drafts, voice transcription, rewrite suggestions and automatic translation, sent to approved models with provider data collection denied
- Processing location
- United States, and the location of the approved model provider
AI model providers
When AI features are enabled, OpenRouter forwards each request to the provider hosting the approved model. HLT names the approved models in the security pack and never switches to unapproved models or providers automatically.
What this list means
- Provider certifications and reports cover the provider’s own services. They do not certify HLT Cloud.
- EU storage locations do not mean that every processing step stays in the EU or in Germany.
- HLT announces new or replaced subprocessors to customers in advance, as set out in the data processing agreement, so that they can object.