Subprocessors
The service providers we use to run SynergicHire that may process personal data our customers entrust to us, including candidates’ information. This list forms Annex 3 of the Data Processing Agreement.
1. Current subprocessors
| Provider | What it does | Personal data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage: the system of record. | Everything the service keeps: accounts, applications and resumes, transcripts, code, recordings, assessments, decisions, audit logs. | Japan (Tokyo) |
| Vercel | Hosts and runs the application. | Whatever a request carries while it is handled; request logs. | United States, with a global network |
| Anthropic | AI models: reading resumes, the screening conversation, the coding assistant, assessments. | The text of resumes, answers, prompts, code and records sent to a model to process. Not used to train models. | United States |
| OpenAI | AI models, as above, the voice of spoken screens, and transcribing a round's recording when one is uploaded. | As above, a spoken screen's audio, and an uploaded round recording while it is transcribed. When the hiring company keeps a screen's audio, the recording is stored for 30 days so we can copy it. Not used to train models. | United States |
| Recall.ai | The meeting notetaker: joins a round's Zoom, Google Meet or Teams call when the hiring company books it, and records the audio. | The call's audio (never video) and its transcript, with participants' display names. We copy both into our storage and then delete Recall.ai's copy. | Japan (Tokyo) |
| E2B | Isolated sandboxes that run candidates' code and tests. | The project's code, commands and their output, for the length of a run. | United States |
| Cloudflare | Turnstile bot check on the public forms. | Network address and browser signals of whoever fills in the form. | Global network |
| Resend | Sends the service's email: invites, receipts, decisions, notices. | Recipient addresses and the email's content. Logs kept 30 days. | United States |
Each is bound by a written agreement to process personal data only for us, with protections no weaker than those in our Data Processing Agreement.
2. Not a subprocessor: Dodo Payments
Dodo Payments is our merchant of record: it sells SynergicHire’s plans to the customer and handles payment and billing details as its own controller, under its privacy policy. It receives no candidate information.
3. Changes to this list
We update this page before a new subprocessor starts handling customer personal data, and email every workspace admin at least 30 days ahead. A customer may object on reasonable data protection grounds, as the DPA sets out in section 6. To ask about this list, write to tech@synergichire.com.