Subprocessors

Draft: not legal advice, pending review by counsel. This page is a working draft, not a published subprocessor list. Placeholders in square brackets must be replaced and the whole document reviewed by qualified counsel before launch.

1. Purpose of this page

This page lists the service providers that may process personal data on our behalf. It is intended to support the privacy policy and customer due diligence. It does not grant subprocessors any independent right to use customer data.

2. Current subprocessors

Subprocessor	Purpose	Data categories	Location	Contract
OpenRouter	Route grading requests to language models and return model output	Job and rubric content, candidate submission text, model prompts and responses	[processing location]	[DPA link]
Supabase	Managed Postgres database, authentication and private file storage	Account data, recruiter content, candidate application data, grading records, recordings, logs	[processing location]	[DPA link]
Hetzner	Host the backend services, workflows and isolated code-execution sandbox	Application data in transit, service logs, submitted code and run output	[processing location]	[DPA link]
Dodo Payments	Hosted checkout, payment processing, tax and invoices as merchant of record	Recruiter account and billing contact details, company name, order and payment metadata	[processing location]	[DPA link]
Resend	Deliver transactional email such as notifications and account messages	Recipient name and email address, notification content and delivery metadata	[processing location]	[DPA link]

[Confirm the production list, legal entity for each provider, processing regions and current DPA links. Remove any provider that is not active in production.]

3. What subprocessors do not receive

We aim to give each provider only the data needed for its function. For example, payment card details are entered on the payment provider's hosted checkout rather than stored by us. This is a design intention; [confirm the final data flow for each provider before publishing.]

We do not sell personal data.

4. Changes

We will update this page before adding a subprocessor that processes personal data in a materially different way, and we will provide notice where a contract or the law requires it. [Confirm the notice period and customer objection process.]

5. Contact

Questions about subprocessors: [privacy contact email].

This draft is not legal advice.