Legal
Sub-processors
Who else is involved in running this, and what each of them can see.
In use today
| Sub-processor | What it does | Where | Candidate data |
|---|---|---|---|
| Hetzner Online GmbH | Servers and storage for the site and the platform | Germany (EU) | Yes, at rest |
| Cloudflare, Inc. | DNS, CDN, TLS termination and bot filtering in front of the origin | US company, global edge network | In transit only |
| Google (Analytics 4) | Aggregate usage statistics on the public marketing site | EU and US | No |
| Namecheap, Inc. | Domain registration and forwarding of mail sent to this domain | US | Only if a candidate emails us directly |
| Let's Encrypt (ISRG) | TLS certificates | US | No |
Not engaged yet
Named here in advance so the list does not quietly grow later. Each will appear in the table above, with at least 30 days notice to customers, before it handles any candidate data.
| Role | Status |
|---|---|
| Transactional email delivery, for sending assessment invitations | Not selected yet. Invitations are not being sent at volume during early access |
| Payment processing | Not engaged. No payments are being taken during early access |
| Customer support tooling | Not engaged. Support runs through email today |
How changes are handled
- Customers are notified at least 30 days before a new sub-processor starts handling candidate data.
- You can object on reasonable data protection grounds within those 30 days. See section 4 of the data processing agreement for what happens then.
- Each sub-processor is bound by terms no weaker than the ones we give you, and we remain responsible to you for what they do.
- To be told about changes by email, ask at [email protected]. Account holders are notified automatically.
What is deliberately absent
No advertising or retargeting networks, no data brokers, no session-recording or heatmap tools, no chat widget, and no enrichment service that looks up who your visitors work for. The cookies page covers the browser side of the same question.