HAIO · Human + AI Orchestration
Data Processing Agreement — HAIO Labs, Inc.
This page publishes the Data Processing Agreement (DPA) summary and the current subprocessor list for the HUMΛN platform operated by **HAIO Labs, Inc.** (Delaware). It is intended for Team and Business beta administrators who need a public processing disclosure without emailing a
Overview
This page publishes the Data Processing Agreement (DPA) summary and the current subprocessor list for the HUMΛN platform operated by HAIO Labs, Inc. (Delaware). It is intended for Team and Business beta administrators who need a public processing disclosure without emailing a founder.
This page does not claim SOC 2 certification. OpsGraph Assurance and related controls produce evidence for a compliance program; they are not a certification.
For signed enterprise DPAs, contact support@haio.run. Terms of Service and Privacy Policy remain subject to outside counsel review before they are treated as final.
Roles
| Role | Party |
|---|---|
| Controller (typical SaaS customer) | The customer organization that determines purposes of processing for its end users |
| Processor | HAIO Labs, Inc., operating the HUMΛN platform (Passport, Command Plane, HumanOS, Workforce, Academy) |
| Subprocessors | Infrastructure and messaging vendors listed below |
Where a customer self-hosts or brings their own model keys (BYOK), processing boundaries follow the customer’s deployment and vault configuration. Human-owned Passport data remains under the human’s control per HUMΛN Principle One.
Data Processing Agreement (summary)
HAIO Labs, Inc. (“Processor”) processes personal data on documented instructions from the customer (“Controller”) to provide the HUMΛN platform, including identity, orchestration, messaging, billing, and support.
Processor shall:
- Process personal data only on documented customer instructions and as required to operate the contracted services.
- Ensure persons authorized to process personal data are bound by confidentiality.
- Implement appropriate technical and organizational measures (encryption in transit, access control via Passport/delegation, provenance logging, vault-backed secrets).
- Engage subprocessors only under written agreements that impose obligations no less protective than this DPA summary, and maintain the public list below.
- Assist the Controller with data-subject requests and reasonable security incident notice without undue delay after confirming a personal-data breach affecting customer data.
- Delete or return personal data after the end of the service relationship, subject to legal retention and ledger/provenance immutability constraints disclosed in product documentation.
- Make available information reasonably necessary to demonstrate compliance with these processor's obligations upon written request.
Governing entity: HAIO Labs, Inc. — see corporate formation records for EIN and Delaware filing details.
This public summary is provided for transparency during soft launch. A long-form countersigned DPA may be required for enterprise procurement; request it at support@haio.run.
Subprocessors
Dated table. Regions reflect primary processing locations we operate or configure today. Updates will be reflected on this page.
| Subprocessor | Purpose | Region(s) | Notes |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute (Workers), Durable Objects (ledger), DNS/CDN | Global anycast; customer traffic nearest PoP | Platform edge and ledger consensus path |
| Railway Corporation (or successor host) | API application hosting, Postgres, Redis | US (primary) | Control-plane API and relational storage |
| Twilio Inc. | Transactional SMS (Passport phone OTP) | US / Twilio routing | Platform messaging vault connector |
| Twilio SendGrid | Transactional email (OTP, invites, product mail) | US / SendGrid routing | Platform email-sendgrid connector |
| Stripe, Inc. | Billing, subscriptions, invoices | US | Payment processing; card data stays with Stripe |
| Functional Software, Inc. (Sentry) | Application error monitoring | US | Operational telemetry; minimize PII in events |
| OpenAI, L.L.C. / Anthropic PBC (and other model providers configured for HUMAN_HOSTED) | Optional hosted LLM inference when the org uses HUMAN_HOSTED compute | Provider regions per model | Not used for BYOK org keys; customer chooses compute mode |
Customer-configured connectors (Slack, Google, CRM tools, and similar) process data under the customer’s own vendor agreements when the customer installs them. Those are not HAIO Labs subprocessors unless HAIO Labs itself operates the connection on the customer’s behalf.
Support and privacy contact
One support address for product and privacy requests during soft launch:
Related surfaces
Build with HUMΛN
Builders