When a company uses deciml as its own applicant tracking system, the company controls its applicants' data and Birch & James Associates Ltd (trading as deciml and TechChain Talent) processes it on the company's instructions. This page lists the suppliers we use to do that (our sub-processors), what each one receives, where, and under which terms. It is Annex 3 of the Data Processing Agreement in the Client ATS Terms.
This version is a draft for solicitor review. No company has accepted the Client ATS Terms yet, so no supplier below processes a company's applicant data today. For how we handle candidates' data as controller, see our Privacy Policy (section 5).
1. Sub-processors
"Operative" suppliers receive applicant data once a company's workspace is in use; "limited" ones only for the purpose stated. An "onward" supplier receives it only as another supplier's sub-processor and is named so the chain is complete.
Supabase (Operative)
Contracting entity
Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Service
Database, file storage and authentication data: the production Postgres database and private file storage for CVs and attachments.
Data categories
Every category in Annex 1, held as host. Files are read only through server-signed links.
Location
AWS eu-west-1 (Ireland); the backup restore-check project in eu-central-1 (Frankfurt), wiped after each check.
Transfer mechanism
Data held in the EU (Ireland, adequate for the UK). The DPA incorporates the ICO Addendum for restricted transfers.
OpenRouter, Inc., 169 Madison Ave #2404, New York, NY 10016, USA
Service
AI routing for the must-have checklist and the written strengths and gaps on an application. Every call is pinned to Anthropic with fallbacks off.
Data categories
The candidate's title, bio, skills, employment history, education degree and field, verified GitHub and on-chain scores, and the role's text and must-haves. Never the name, contact details, CV file, wallet, social handles or location; names and gender words are removed from the free text.
Location
United States.
Transfer mechanism
EU Standard Contractual Clauses with the UK Addendum.
Rate-limit keys built from user ids, addresses or IP addresses; cached ids and derived results, each expiring within 7 days. No application content, notes or CVs.
Location
Region chosen at creation (to be confirmed).
Transfer mechanism
EU-US Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Transfer Addendum.
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA
Service
Turnstile bot protection on the apply form; R2 storage for encrypted backups.
Data categories
Turnstile: the visitor's IP address and browser signals. R2: the database and stored files, encrypted with our key before upload, so Cloudflare holds ciphertext only.
Location
R2 in Western Europe (location hint); Turnstile on Cloudflare's global network.
Transfer mechanism
EU Standard Contractual Clauses with the UK Addendum, and the Data Privacy Framework with its UK Extension.
GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA
Service
Actions runners for the nightly backup and the backup restore check only; nothing else.
Data categories
The database and stored files pass through the runner during the job, before they are encrypted; the runner is destroyed after each job. The repository, logs and issues carry no applicant data.
Location
Placed by GitHub (Azure, predominantly US); treated as US.
Transfer mechanism
EU Standard Contractual Clauses with the UK Addendum, and the Data Privacy Framework with its UK Extension.
PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA
Service
Product analytics on client-user sessions, after consent where it is required.
Data categories
The user id and role; page addresses with record ids replaced. Portal text is masked, no search text is sent, and session recording is off.
Location
EU Cloud (Frankfurt).
Transfer mechanism
EU Cloud data stays in the EU; for any US processing, the UK Addendum to the EU Standard Contractual Clauses and the Data Privacy Framework with its UK Extension.
We use these suppliers for other parts of our service. We checked that none of them receives a company's applicant data, and we check again before each new version of this list.
OpenAI: Embeddings of deciml-controlled profiles and job text only. Profiles a company added are skipped, and nothing specific to an application is embedded.
Telegram: No applicant data in any company-facing message: Telegram carries only candidates' own opted-in notifications and the public jobs channel.
Google Workspace: Our staff and business mail only. A client user's interview invitations go to the client's own connected Google account.
Manatal: TechChain's own agency ATS, read only; client workspaces use it only as a label on an agency-sourced application.
3. Changes to this list
At least 30 days before we add or replace a sub-processor, we publish a new version here and email the admins of each company that has accepted the Client ATS Terms, naming the new supplier, what it does, the data it receives, where, and the transfer safeguards. Admins do not need to sign up for these notices. A company can object on reasonable data-protection grounds under the Data Processing Agreement (clause SIXTH) by writing to support@deciml.io before the change takes effect.
, version 1.0-draft
First list, reconciled from the code and each provider's published terms (Annex 3, version 1). A draft for solicitor review: no client applicant data is processed under it yet.