Subprocessors
Last updated: October 7, 2026
1. Current subprocessors
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| Google Cloud / FirebaseGoogle LLC | Application hosting (App Hosting), database (Cloud Firestore), authentication (Firebase Authentication), file storage (Cloud Storage), secret management | All Customer Data, including candidate data and uploaded files; account data | United States |
| OpenAIOpenAI, L.L.C. | AI features: candidate screening suggestions, rankings and job-description drafts — only when a customer's user runs an AI feature | Job requirements and the application content needed for the task (e.g. resume text, answers); never voluntary EEO self-identification data | United States |
| StripeStripe, Inc. and affiliates | Subscription billing, payment processing, invoices and the customer billing portal | Billing contacts, billing address, tax IDs, payment details (no candidate data) | United States |
| ipwhois.ioipwhois.io (IP geolocation API) | Approximate location (country, region, city) for careers-page visit statistics | A truncated network address of the visitor (IPv4 last octet removed, IPv6 reduced to its /48 prefix); no candidate data, nothing stored by us | Global |
| ResendResend (transactional email provider) | Delivery of transactional emails such as team invitations and hiring notifications | Recipient name and email address, and email content (which may reference candidates) | United States |
List current as of October 7, 2026.
2. Safeguards
Each subprocessor is bound by a written agreement with data-protection obligations at least as protective as our Data Processing Addendum, including confidentiality, security and, for transfers from the EEA, UK or Switzerland, appropriate transfer safeguards such as the Standard Contractual Clauses. Our AI provider processes data under API terms that do not permit training its models on that data.
3. Changes and notifications
We notify workspace owners by email at least 30 days before a new subprocessor starts processing customer personal data, and update this page. Customers can object as described in the DPA. To receive notices at another address, email [Privacy email] with the subject "Subprocessor updates".