Version 1.0-draft
Draft for review. These terms are not yet offered for acceptance, and marked fields are still to be completed.
Version 1.0-draft
Not a final authorised list. The names below reproduce the supplied account of the register/notice, not verified contractual entities or confirmed applicant-data routes. No inference is made from a supplier's brand about its function or hosting location.
For every relevant provider, complete: contracting legal entity and address; actual ATS service; data categories and access; processing and remote-access countries; relevant onward providers; DPA and contractual restrictions; retention/deletion; transfer mechanism and required assessment; and approval date/version. If a supplier receives no Customer Applicant Data, record the evidence and exclude it from the operative sub-processor list. A notice reference alone is not authorisation.
To complete: the reconciled sub-processor annex (docs/legal/subprocessor-annex-v1.md, owner instructions item 4.2), adding Sentry, Inngest and Google Workspace to the reconciliation (supplement v1, section 6)
| Name supplied | Source status reported | Required disposition |
|---|---|---|
| Anthropic | Named in notice/register section 2 | Verify applicant-data route and complete all fields before authorisation |
| Cloudflare | Named in notice/register section 2 | Same; examine relevant traffic, metadata and logging access |
| Manatal | Named in notice/register section 2 | Verify whether used for this client ATS or only separate recruitment services |
| OpenRouter | Named in notice/register section 2 | Verify routing, actual downstream model providers and contracting chain |
| PostHog | Named in notice/register section 2 | Verify analytics scope and whether applicant data, recordings or identifiers are collected |
| Resend | Named in notice/register section 2 | Verify message content, identifiers, logs and deletion |
| Supabase | Named in notice/register section 2 | Verify actual storage/database scope and locations |
| Telegram | Named in notice/register section 2 | Verify whether applicant information enters notifications; do not assume a suitable processor contract exists |
| Upstash | Named in notice/register section 2 | Verify actual data, cache/queue retention and deletion |
| Vercel | Named in notice/register section 2 | Verify runtime, hosting, logging and remote-access scope |
| OpenAI | Listed as a gap | Determine actual use; authorise before transmission if relevant, otherwise document exclusion |
| GitHub | Listed as a gap | Determine whether applicant data enters repositories, actions, issues or other services; do not infer access from code hosting alone |
The account also mentions unnamed "others". The full register and a data-flow/integration review are necessary to identify them; they cannot be invented or silently treated as covered. No applicant data should pass through an unverified provider pending reconciliation. Where a provider determines its own purposes, investigate the controller relationship rather than labelling it a sub-processor to fit this annex.