Subprocessors
The service providers we use to run SynergicHire that may process personal data our customers entrust to us, including candidates’ information. This list forms Annex 3 of the Data Processing Agreement.
1. Current subprocessors
| Provider | What it does | Personal data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage: the system of record. | Everything the service keeps: accounts, applications and resumes, transcripts, code, recordings, assessments, decisions, audit logs. | Japan (Tokyo) |
| Vercel | Hosts and runs the application. | Whatever a request carries while it is handled; request logs. | United States, with a global network |
| Anthropic | AI models: reading resumes, the screening conversation, the coding assistant, assessments. | The text of resumes, answers, prompts, code and records sent to a model to process. Not used to train models. | United States |
| OpenAI | AI models, as above, and the voice of spoken screens. | As above, and a spoken screen's audio. When the hiring company keeps audio, the recording is stored for 30 days so we can copy it. Not used to train models. | United States |
| E2B | Isolated sandboxes that run candidates' code and tests. | The project's code, commands and their output, for the length of a run. | United States |
| Cloudflare | Turnstile bot check on the public forms. | Network address and browser signals of whoever fills in the form. | Global network |
| Resend | Sends the service's email: invites, receipts, decisions, notices. | Recipient addresses and the email's content. Logs kept 30 days. | United States |
Each is bound by a written agreement to process personal data only for us, with protections no weaker than those in our Data Processing Agreement.
2. Not a subprocessor: Dodo Payments
Dodo Payments is our merchant of record: it sells SynergicHire’s plans to the customer and handles payment and billing details as its own controller, under its privacy policy. It receives no candidate information.
3. Changes to this list
We update this page before a new subprocessor starts handling customer personal data, and email every workspace admin at least 30 days ahead. A customer may object on reasonable data protection grounds, as the DPA sets out in section 6. To ask about this list, write to synergichire@raymish.com.