Subprocessors

Amazon Web Services

Purpose: Cloud hosting, infrastructure and storage.

Data Processed: User account data; candidate and employee identifiers, assessment responses, and derived scores; technical data (IP address, browser, login timestamps).

Location of Processing: EU

Registered Business Address: Amazon Web Services EMEA Société à Responsabilité Limitée 38 Avenue John F. Kennedy, L-1855 Luxembourg

Auth0

Purpose: Authentication, single sign-on and session management.

Data Processed: Name, email address, IP address, login timestamps, SSO metadata.

Location of Processing: EU

Registered Business Address: Okta, 100 1st Street, San Francisco, CA 94105, USA

Chargebee

Purpose: Subscription, invoicing and billing management.

Data Processed: Customer contact and billing information, subscription and invoice history, payment tokens.

Location of Processing: EU

Registered Business Address: Chargebee Inc., 909 Rose Avenue, Suite 610, North Bethesda, MD 20852-8764, USA

CookieYes

Purpose: Cookie consent management.

Data Processed: IP address, cookie IDs, browser metadata, consent preferences

Location of Processing: EU

Registered Business Address: CookieYes Limited, 5 Brayford Square, London E1 0SG, United Kingdom

Google

Purpose: Support email inbox, employee SSO, website analytics.

Data Processed: Name, email address, email content, anonymized IP address, browser metadata, website usage data.

Location of Processing: EU and US (SCCs and DPF)

Registered Business Address: Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA

HubSpot

Purpose: Demo and contact forms, marketing, newsletters, ticketing and customer support.

Data Processed: Contact information, support and form messages, marketing engagement data, IP address, browser metadata.

Location of Processing: EU

Registered Business Address: HubSpot Ireland Ltd, 1 Sir John Rogerson's Quay, Dublin 2, Ireland

ImageKit

Purpose: Image processing and CDN delivery.

Data Processed: Optional profile photos and company logos.

Location of Processing: EU

Registered Business Address: ImageKit Inc, Christiana Corporate Business Center, 200 Continental Drive, Suite 401, Newark, DE 19713, USA

Microsoft Azure

Purpose: Cloud infrastructure and AI inference for in-product features.

Data Processed: Job description text, aggregate assessment scores, user-authored prompts.

Location of Processing: EU

Registered Business Address: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Preset

Purpose: Analytics and Data Visualization.

Data Processed: Names, email addresses, assessment results or organizational data shown in dashboards.

Location of Processing: EU

Registered Business Address: Preset, Inc. 107 South B St, 2nd Floor, San Mateo, CA, 94401 | 650-590-9566 | info@preset.io

Pusher

Purpose: Real-time updates over websockets.

Data Processed: Name, email address, session metadata, notification and chat content in transit.

Location of Processing: EU

Registered Business Address: MessageBird UK Limited, 160 Old Street, London EC1V 9BW, United Kingdom

Sentry

Purpose: Error reporting and diagnostics.

Data Processed: Error logs and session metadata. Personal data is redacted before processing.

Location of Processing: EU

Registered Business Address: Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA

Stripe

Purpose: Card payment processing (only for customers paying by card).

Data Processed: Customer contact and billing information, subscription and invoice history, payment tokens.

Location of Processing: EU and US (SCCs and DPF)

Registered Business Address: Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland

GROUP SUB-PROCESSORS

The following are group members of Idalto Inc, these entities function as sub-processors as well with one or more entities providing support and maintenance.