← Back to Security
Sub-processors
The third parties that process personal data on our behalf. To request copies of the relevant DPAs / transfer safeguards, email contact@personallyhired.com.
Currently active
These providers process personal data today.
| Sub-processor | Purpose | Personal data | Location / transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting & content delivery (CDN) | Request/usage data in transit, server logs, IP address | US company; served from the EU (Frankfurt). DPA with EU SCCs. View DPA → |
| Neon Inc. | Managed PostgreSQL database (primary data store) | All application data (accounts, applications, etc.) | US company; data hosted in AWS eu-central-1 (Frankfurt, EU). DPA with EU SCCs. View DPA → |
| Resend (Resend, Inc.) | Transactional & notification email delivery | Recipient name & email address, and message content (e.g. account confirmations, password resets, hiring notifications) | US company; email processed in the EU (Ireland, AWS eu-west-1). DPA with EU SCCs. View DPA → |
| Vercel Blob (Vercel Inc.) | Private storage for candidate-uploaded résumé files | Résumé documents (candidate personal data) | Stored in the EU (Frankfurt). Private access — files are served only to the owning employer via authenticated, time-limited links, never publicly. DPA with EU SCCs. View DPA → |
Planned
Mocked today; these become active at launch as integrations go live.
| Sub-processor | Purpose | Personal data | Location / transfer safeguard |
|---|---|---|---|
| Google (reCAPTCHA) | Bot / abuse prevention | IP address, interaction signals | USA. Google DPA / SCCs / DPF. |
| Scheduling (e.g. Calendly / Google / Microsoft) | Interview scheduling | Name, email, calendar event | TBD. DPA / SCCs. |
| Whereby | Private 1:1 video rooms for booked introductory calls | Participant display name; in-call audio/video; connection metadata | EEA-based provider (Norway); call-media routing region to be confirmed with Whereby. |
| Payments (e.g. Stripe) | Subscription billing | Billing contact, payment metadata | USA/EU. DPA / SCCs. |
Source code is stored on GitHub (USA); it does not contain production personal data. We aim to keep processing within the EU; where a provider is US-based, transfers rely on SCCs / the EU-US Data Privacy Framework via their DPA. See our Privacy Policy and Security overview.