Security
The case holds passports, contracts, and salaries. We treat it that way.
Relocation cases contain personal and legal information. Here is where it lives, who processes it, and how it is protected.
- Where your data lives
- Case data is stored in the EU, in Ireland (AWS eu-west-1), via Supabase.
- Who else processes it
- The sub-processors listed below — including AI and email providers, some based in the US under standard contractual clauses.
- Personal data is masked
- Passport numbers, IBANs, national ID numbers, phone numbers and email addresses are masked before any text is sent to an AI provider.
- Encryption
- Data is encrypted in transit (TLS) and at rest (AES-256).
- Access controls
- Role-based access throughout. HR sees its own company’s cases. Employees see only their own record. Each company’s cases are kept separate from every other company’s.
- Data use
- Your relocation data is used only to run your cases. It is never sold.
- Questions
- Security questionnaire or DPA? Email contact@relopass.com.
Sub-processors
| Provider | Used for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Render | Application hosting | On request |
| Cloudflare | DNS and content delivery | Global edge (US company) |
| OpenAI | AI features: policy search, extraction and Q&A (masked text). Used only when AI features are enabled; off by default | US |
| Anthropic | AI features: policy assistant and roadmap drafting (masked text). Used only when AI features are enabled; off by default | US |
| Mistral AI | Document text extraction. Used only when enabled; off by default | EU (France) |
| Resend | Transactional email | US company |
| PostHog | Product analytics (with consent) | EU |
| Geoapify | Address lookup | EU (Germany) |