Subprocessors
A subprocessor is a third party that handles personal information on our behalf so that we can provide the hosted service.
This page covers the hosted service only. If you run the Software on your own infrastructure under a licence, none of this applies to your operational data — you choose your own providers, and we never receive it. See the Privacy Policy §14.
Two things are worth understanding before you read the tables:
- Most of this list is optional and you control it. The integrations in §2 send data to a provider only if you connect that provider. A carrier that connects nothing sends operational data to nobody in §2.
- The list in §1 is not optional. Those providers are how the service runs at all — Google among them, which is sent what you enter in address fields, from every account.
1. Always in use
These support every account.
| Provider | What it does | Personal information involved | Where |
|---|---|---|---|
| Microsoft Azure | Hosting, database, object storage, secrets, and the network edge (Azure Front Door) that every request to our web addresses reaches first | All hosted data, at rest and in processing. At the edge: every request to the product and every response, decrypted there before being encrypted again for our servers, and a log of each request — the IP address, the web address requested, what the browser reports about itself, the time and the result | Stored data and our servers: Canada (Canada Central). The edge is not confined to Canada: Microsoft answers each connection at an edge location near the person connecting, which can be in another country — see the Privacy Policy §8. The request log is kept in Canada for 30 days |
| Microsoft Azure AI Foundry | The optional AI features in §3 | Only what §3 describes, and only for accounts that enabled them | Account in Canada; inference is not confined to Canada — see §3 |
Stripe (stripe) | Subscription billing and card payments, for accounts that pay by card | Your billing contact, company name, subscription and invoice records. We never receive or store your full card number | United States |
| Apple (iCloud Mail relay) | Sending outbound email — quotes, invoices, notifications, account mail | Sender and recipient addresses, subject and message content, attachments | Outside Canada. Apple does not publish a processing location for iCloud Mail |
Google (Maps Platform) (google-maps) | Address suggestions as an address is entered, and a preview map of the place picked, in every account; road routes and the interactive map only where your account has the Google routing add-on | What is in an address field — as it is typed, and an address already in the field when a form opens — for pickup and delivery stops, customer billing addresses, terminals, relay points and lane rates; the place you pick, and its coordinates for the preview map; and, for a road route, the coordinates of its stops. Those requests come from our servers, not from your browser. The interactive map is the exception: your browser loads it directly from Google, which receives your IP address and the area of the map you are viewing | United States. Google's endpoints are global, so these requests are not confined to Canada |
| Expo (Expo Application Services) | Delivering push notifications to the driver mobile app | Device push token, the notification's title and body, and the record identifiers the app opens on | United States |
The driver app's push notifications reach the device through Apple's or Google's push service after Expo, which is how push works on those platforms and is not something an app can route around.
One more recipient is not in these tables, because our servers send it nothing. The tracking page you can share with your customers, and the map screens of accounts on self-hosted routing — or of any account, when the product cannot confirm which routing add-on it has as the screen loads — are drawn from map images that the reader's browser fetches directly from the OpenStreetMap Foundation. It receives that reader's IP address and the area of the map being shown. The Privacy Policy §6 says more.
2. Integrations you choose to connect
Each row applies only if you connect that provider. Connecting one is an explicit action in Settings → Integrations, taken by an administrator of your company.
| Integration | Key | Category | What we send | What we receive |
|---|---|---|---|---|
| QuickBooks Online (Intuit) | quickbooks | Accounting | Customers, invoices, line items, payments, expenses | Sync status, matched records |
| Xero | xero | Accounting | Customers, invoices, line items, payments, expenses | Sync status, matched records |
| Zoho Books | zoho-books | Accounting | Customers, invoices, line items, payments, expenses | Sync status, matched records |
| Samsara | samsara | Telematics | A linked vehicle's identifier and a trip's time window, when reading that trip's distance; the other reads ask for your whole fleet's current data | Vehicle positions with speed and heading, and the driver the device reports; a vehicle's distance and odometer readings by province or state over a trip; each driver's current duty status and remaining driving, on-duty and cycle time, which the product displays and does not save to its database; and, when you review it, the provider's list of your vehicles (name, VIN, make, model, year, plate) and drivers (name, licence number, phone, email) |
| Motive | motive | Telematics | A linked vehicle's identifier and a trip's time window, when reading that trip's distance; the other reads ask for your whole fleet's current data | Vehicle positions with speed and heading, and the driver the device reports; a vehicle's distance and odometer readings by province or state over a trip; each driver's current duty status and remaining driving, on-duty and cycle time, which the product displays and does not save to its database; and, when you review it, the provider's list of your vehicles (name, VIN, make, model, year, plate) and drivers (name, licence number, phone, email) |
| Geotab | geotab | Telematics | A linked vehicle's identifier and a trip's time window, when reading that trip's distance; the other reads ask for your whole fleet's current data. When you ask the product to add a driver to MyGeotab, that driver's name, email address, phone number, licence number and time zone | Vehicle positions with speed and heading, and the driver the device reports; a vehicle's distance and odometer readings by province or state over a trip; each driver's current duty status and remaining driving, on-duty and cycle time, which the product displays and does not save to its database; and, when you review it, the provider's list of your vehicles (name, VIN, make, model, year, plate) and drivers (name, licence number, phone, email) |
| Gmail / Google Workspace | gmail | Mailbox | Mail you send from the product | Message content and attachments from the connected mailbox |
| Microsoft Outlook | outlook | Mailbox | Mail you send from the product | Message content and attachments from the connected mailbox |
| Twilio | twilio | SMS | Recipient phone number and message content | Delivery status |
| WhatsApp Business (Meta) | whatsapp | Messaging | Recipient phone number and message content | Delivery status, and replies where inbound is enabled |
| WhatsApp via Twilio | twilio-whatsapp | Messaging | Recipient phone number and message content | Delivery status, and replies where inbound is enabled |
| WhatsApp via Bird (formerly MessageBird) | bird-whatsapp | Messaging | Recipient phone number and message content | Delivery status, and replies where inbound is enabled |
| Slack | slack | Notifications | Notification content posted to your workspace | Delivery status |
| WEX | wex | Fuel card | Card and account identifiers, and the period being polled | Fuel transactions — merchant, location, amount, and the card's driver and vehicle |
| Comdata | comdata | Fuel card | Card and account identifiers, and the period being polled | Fuel transactions — merchant, location, amount, and the card's driver and vehicle |
| EFS / WEX Fleet One | efs | Fuel card | Card and account identifiers, and the period being polled | Fuel transactions — merchant, location, amount, and the card's driver and vehicle |
| DAT | dat | Load board | Not released. No data is exchanged | — |
| Truckstop | truckstop | Load board | Not released. No data is exchanged | — |
A mailbox connection is the one to read twice. Connecting Gmail or Outlook syncs message content and attachments into the product — including messages that have nothing to do with freight, if the mailbox carries them.
All providers in this table operate outside Canada, mainly in the United States, and information exchanged with them is processed there under the laws of that country.
3. AI features, and what they send
The AI features are an optional paid add-on, off by default, enabled per company by an administrator, and each individual feature has its own switch. A company that has not turned them on sends nothing to any AI provider.
When they are on, the request goes to Microsoft Azure AI Foundry. The account is in Canada Central, and the model runs on a Global deployment, which means Microsoft may perform the inference in any Azure region worldwide. We say so plainly because "your data stays in Canada" would not be true of these features.
| Feature | What is sent |
|---|---|
| Mailbox triage | For each conversation in a connected mailbox whose newest received message the product's own rules cannot sort: that message's sender name and address, subject, whether it has attachments and the first 2,000 characters of its body, with — where it applies — a note that the company already corresponds with the sender or that the conversation is filed against one of its records |
| Compose assist | The draft you typed, up to 10,000 characters, and its subject line; for a draft written from scratch, the goal you stated; and, for a message linked to a load, that load's number, its lane as origin and destination city and province, equipment, pickup and delivery windows, rate and customer name |
| Hena AI — the question | The question asked (up to 400 characters), up to 12 earlier messages of the same conversation, today's date in the company's time zone, and the screen it was asked from |
| Hena AI — the look-ups behind the answer | Reads of your own company's records, up to 20 rows of text per look-up: trip, order and invoice numbers with customer names, dates, statuses, amounts, amounts paid and balances; lanes as origin and destination city and province; equipment types; assigned driver names; customer names with city and province; driver presence with where and when each last delivered; truck unit numbers with status, driver name, how long ago the last position was reported, the stop being headed to and the estimated arrival; one opened record's stops with city, province, times, appointment flags and the instructions typed on them, plus notes, reference numbers, invoice lines and payment totals; delivered orders not yet invoiced with their amounts; and up to 20 rows of a report: a built-in one — lists of trips, orders and invoices with numbers, customer names, lanes, equipment, statuses, dates, amounts, amounts paid, balances, margins and carrier pay, or totals by driver, carrier, truck, customer, lane, status, charge type, expense category or jurisdiction, including each driver's trips, stops, hours worked (first arrival to last departure, not hours of service) and on-time rate — or one Hena groups itself by any column the requesting role can read in the report catalogue, whose group labels can then be any such value, including a customer's billing email address or phone number, a carrier or vendor name, or a typed description or reference, and which, for roles allowed to see driver pay, can total what each driver was paid. Counts and money totals are computed over the whole set and sent as figures. No street addresses and no GPS coordinates are sent. Help-page extracts carry no personal information |
| Report drafting | The report description typed (up to 2,000 characters), the report datasets and columns the requesting role may use — names and descriptions, no records — and, for a redraft, the report definition currently in the builder, including its name and any typed filter values such as a customer name. No rows from your records |
| Scheduled report summary | Unattended, each time a report schedule set to send a CSV and to summarise it runs, for a report of at most 2,000 rows read under the role of the person who last saved the schedule: the report's name, date range and row count; each column's label and type; per numeric column its total, average, lowest and highest value and how many rows held a value; money totals per currency; up to three breakdowns naming the eight largest values of a text, status or yes/no column — the report's own cells: a customer's, carrier's, vendor's or driver's name, a status, a city, a typed description or reference, a customer's billing email or phone — with row counts, shares and totals plus one folded "Other" row; a trend by day, week or month on the first date column; and the first 40 rows of the report as they appear in the CSV, every column included — trip, order and invoice numbers, customer and driver names, lanes, dates, amounts, margins, carrier pay, worked hours and, for the roles allowed to see it, each driver's pay — with text cells cut at 120 characters. No street address, GPS coordinate or licence number: the report catalogue has no such column. The narrative returned is printed in a PDF marked as written by AI and emailed with the CSV to the schedule's recipients, members of the company; it is kept only inside that PDF, cleared a day after the run |
| Explaining a dispatch suggestion | For one suggested driver and load: the driver's name, the load number and up to 12 of the reasons the product's own ranking gave — which can include the driver's availability and working pattern, approved time off, time since their last load, where and when they come free, distance to the pickup, hazmat endorsement, standing trailer fit, lapsing truck or trailer paperwork, and the duty status and remaining driving time their telematics provider reports |
| Checking the dispatch plan | Per suggestion, up to 10: the load's number, status, customer name, lane as origin and destination city and province, equipment, rate (unless the company's dispatch board hides money), requirements and notes as typed; each stop's city and province, scheduled time and window, appointment flag and instructions as typed; and the suggested driver's name, licence class, hazmat endorsement and driver type, availability, open loads, standing truck and trailer unit numbers with their readiness and any registration, insurance or inspection lapsing before the pickup, the telematics provider's duty status and remaining driving, on-duty and cycle time, where and when they come free, distance and drive time to the pickup, and the ranking's reasons. No street addresses, coordinates or phone numbers |
| Autonomous dispatching | Nothing |
| Suggesting a response to a late load | On request, for a load that is late or at risk: the load number, how late it is expected to be and, where known, the assigned driver's name and how many minutes ago the load's position was last reported |
| Trip planner | The request you typed (up to 300 characters); for the "why this set" line on one proposed trip, order numbers, customer names, pickup and delivery city names, pallet positions, appointment flags, trailer type, the rule verdicts, the spread in minutes between pickups, and the first-reaching driver's name, reach verdict and estimated miles; and, for the review of a whole day's plan, the day, the off-route tolerance in miles, and per proposed trip the order numbers, customer names, pickup and delivery city names, trailer type, pallet positions against trailer capacity, the rule verdicts, the chosen driver's name, reach verdict and estimated miles, and the planner's estimated miles, minutes and count of late stops for that trip — plus the order numbers not placed with a reason code and the plan's checks by outcome. An empty plan is not sent. No addresses, coordinates, phone numbers, prices or position history |
| AI live tracking on the Power board | A scheduled check every five minutes, with no request from a person. Per trip that is assigned or in transit and has a driver or carrier assigned or a source reporting, up to 40 trips per request: a per-request trip index (not the load number), the trip's status, the product's rule-based reading of the trip, and for each location source that has reported — telematics device, driver's phone, and the truck's last known position only once the trip is in transit — the age in minutes of its latest position and its reported speed; the miles between each pair of sources; remaining stops and straight-line miles; the rule-based arrival estimate in minutes; and the minutes between that estimate and the delivery window. A trip checked in the last 10 minutes with no newer position is not re-sent that round. No GPS coordinates, no addresses, no driver name, customer name or load number. Where a source is the driver's phone, its age, speed and distance are still information about that driver |
| Driver questions on WhatsApp | The driver's typed message, as written, and reads of that driver's own trips through the driver app's own projection: the trip number, customer name, status, dates and typed notes; equipment and unit numbers; the driver's own stops with full street address, scheduled time and window, appointment flag, reference and typed instructions; and the paperwork still owed with its labels and instructions. No money, no other driver and no trip that is not theirs — a trip number that is not the driver's is refused rather than read. No pay, no hire or termination dates, and no licence or medical-card expiry. No GPS coordinates — a stop reaches the model as an address, never as a position. The stored copy of the message is capped at 4,096 characters and pruned at 90 days |
| Reading a quotation reply | When someone opens a mailbox conversation filed against an order still awaiting the customer's answer: the order number, the quoted total, and the plain text of the customer's latest reply, up to 8,000 characters |
| Suggesting a price | Only when no lane rate or customer base fare is on file: the lane as origin and destination city and province, equipment, distance where known, currency, and up to 8 delivered loads on the same lane with the same equipment in the last six months, each with its load number, total and delivery date |
| Expense statement import | For up to 300 of the charges on the fuel-card or bank statement you uploaded: each line's description as printed, and its amount. No dates |
| Matching spreadsheet columns | On a customer, carrier, driver, truck or trailer import: the headings of the columns the product could not match itself, up to five example values from each, and the list of fields they might fill. The examples are whatever those columns hold — in a driver spreadsheet, possibly names, phone numbers or licence numbers |
| Branding template suggestion | The logo or sample document image you uploaded — the first page, where it is a PDF |
Five commitments about it:
- We do not send your data for model training. Microsoft's terms for this service commit that prompts, responses and embeddings are not made available to the model's provider, are not used by that provider to improve its models, and are not used to train any foundation model or improve Microsoft or third-party products without our explicit instruction.
- We do not store the text we send. Metering only — which feature, whether it succeeded, how many tokens, and how long it took.
- We store an AI answer only where the answer is the feature — mailbox triage saves the label and one-line summary it produces for a thread; AI live tracking keeps one reading per trip — chosen source, arrival estimate and minutes late, status, a note of up to 280 characters and when it was made, with no position, speed or source timestamp — replaced each time the trip is checked and deleted once the trip is delivered or cancelled; and the scheduled report summary's narrative is kept only inside the PDF made for that run while it waits to be emailed, cleared a day after the run. Other features' answers are returned to the person who asked and not retained.
- Microsoft screens requests for abuse of its own service. Where a pattern suggests misuse, a sample of prompts and responses may be reviewed — normally automatically, and in some cases by authorized Microsoft employees under time-limited approved access. Anything stored for that review stays in the region we designated, which is Canada.
- Nothing an AI feature produces writes to your records. Almost every result is a proposal a person accepts or discards. AI live tracking's reading is shown on the Power board, marked "AI", without anyone accepting it — only after it is checked against the evidence, and only while it is no more than 15 minutes old — but it changes no trip status, records no arrival and sends no notification. The driver WhatsApp assistant's reply is sent to the driver who asked without anyone reading it first. It still writes nothing, and it can take no action on a trip. The scheduled report summary's narrative is emailed to the schedule's recipients, marked as written by AI, without anyone reading it first; it changes nothing in the report or in any record.
4. Changing this list
Adding a subprocessor that handles personal information is a change we tell you about before it takes effect, as set out in the Privacy Policy §15.
This page is generated against the product's integration registry and a test fails our build if an integration ships without a row here — so the omission this page is most likely to suffer from is the one we have engineered against.
5. Questions
The Director — support@hexagen.ca