The English text is the authoritative version of this document. It is not translated, because four translations of a legal notice are four texts that can disagree.
The list
Each entry names what the party can reach, not merely that it exists. A sub-processor list that says "cloud hosting" tells a procurement reviewer nothing.
- Database (Postgres) — structured data: candidates, facts, review decisions, access logs. Region configured per deployment.
- Object storage (S3-compatible) — uploaded originals and generated documents. Private bucket; every read goes through an authorised route.
- Transactional email — recipient address and message body. Messages contain a verification or invitation link, never candidate content.
- Model provider (optional, off by default) — the structured profile text, when a workspace enables the drafting assistant.
- Content delivery network — request metadata for the application itself. No candidate data.
What is never sent anywhere
Uploaded files are not sent to a model provider. Candidate documents are not sent to an analytics service, an advertising network, or any party not listed above. There is no analytics service in the product.
Change notice
A new sub-processor is announced to workspace owners before it is used, with what it will receive and where it operates.