Sub-processors

Serves the Halo Benefits web app, routes traffic to our API, and provides DNS.

Sees: The pages you load and what you type into them while it passes through. Your session is held in an encrypted cookie in your browser, not stored by Cloudflare.

Runs our API, sends the service's emails and holds our encrypted backups.

Sees: Everything the app stores and shows.

Runs the AI for Halo AI features, such as the benefits adviser and reading benefit documents. Google Gemini answers first. If Gemini is busy or down, Claude, made by Anthropic, answers instead. A few features use only Claude.

Sees: The text each request needs. For the adviser: the question, with email addresses and long numbers removed, and that employee's own benefit facts. For a pay exchange check, these include pay and pension figures. Never their name or contact details. Google's terms say it does not use customer content to train its models.

Hosts our database.

Sees: Everything the service stores: employer details, HR admin names and emails, employee records, benefit options, prices and choices, and the audit log. Encrypted in transit and at rest.

Signs people in with one-time codes sent by email. There are no passwords.

Sees: Your email address, when you sign in, and the device and network details Auth0 records for security.

Keeps the sign-in service's security logs, so we can spot and look into unusual sign-in activity.

Sees: Your email address, the network (IP) address and browser details of each sign-in, and when it happened. Nothing from your Halo record.

Sends the one-time sign-in codes by email for our sign-in service.

Sees: Your email address, the sign-in code and whether the email was delivered. Nothing from your Halo record.

Deliver notifications to the Halo Benefits phone app, only if you allow notifications.

Sees: A device token and the short notification text. Notifications carry no names, pay amounts or benefit choices.

Turns a spoken question into words, and an answer into speech, for the voice concierge.

Sees: The sound of one question, or the text of one answer. Never your name, employer or Halo record. We ask Deepgram on every request not to use it to improve its models.

Carries phone calls to the Halo Benefits phone line.

Sees: Your phone number and the sound of the call while it lasts, plus the call record (numbers, time and length). Calls are not recorded.

Counts how people use our website and app, such as which pages they open. This helps us make them better.

Sees: The pages you open and the buttons you press, with an internal reference number instead of your name. Never your email, pay, benefit choices or health details. Network addresses are removed. No cookies unless you accept them.

Holds our source code and runs our automated checks.

Sees: None of your information. Our checks use made-up data only.

Connects your employer's HR system (for example Workday, HiBob, Personio or BambooHR) to Halo, read only, if your employer chooses to connect it this way.

Sees: The staff details your employer allows from its HR system: name, work email, employee ID, start and leaving dates, job and department, and pay only if your employer maps it. Your employer's HR system sign-in is held by StackOne, not Halo.

Supplies the gift cards and vouchers for Thrive thank-you gifts.

Sees: The product, its value and a reference number. Never your name, email address or pay.

Delivers notifications through the Halo Teams bot in your employer's Microsoft tenant.

Sees: Your sign-in email for matching, account and conversation references, a short general message and a Halo link.

Delivers direct messages and admin summaries in your employer's Slack workspace.

Sees: Your sign-in email for matching, account and conversation references, a short general message and a Halo link.