Legal
Sub-processors
The third parties that process customer data on our behalf, what each one does, and where it does it.
Last updated: 28 October 2026
| Purpose | Data | Provider | Location |
|---|---|---|---|
| Application and database hosting | All service data, including database backups | OVHcloud (OVH SAS) | France |
| Document storage | Uploaded candidate documents | Amazon Web Services EMEA SARL | Sweden (Stockholm region) |
| AI evaluation and the assistant | Document and transcript text sent for scoring, and questions asked in the assistant | OpenRouter, Inc., which passes each request to the host of the selected model | United States, and the country of the model host |
| Email delivery | Recipient address and message content | Resend | United States |
| Payments and tax | Billing contact and transaction details | Stripe Payments Europe, Ltd. | Ireland, with some processing in the United States |
| Error monitoring | Technical details of errors, with the account or organisation they occurred in | PostHog, EU cloud | Germany |
| Bot protection on sign-up and sign-in | Browser and network signals from the form, no candidate data | Cloudflare, Inc. (Turnstile) | United States |
| Sign-in, when you choose it | Authentication only, no candidate data | Google LLC, Microsoft Corporation | United States |
01What a sub-processor is
- A company we use to deliver HireOSS that, as part of that work, processes personal data belonging to our customers.
- Each one is bound by a written agreement that protects the data at least as well as our own commitments do.
02What runs on our own infrastructure
- Text extraction from scanned documents runs on servers we operate. No third party is involved.
- The model behind search in the assistant also runs on our servers, with no outside provider.
03AI evaluation
- OpenRouter sends each request to a company that hosts the AI model we have chosen. We only allow hosts that do not store prompts or use them for training.
- If the customer has turned on blind screening, names and contact details are removed from the text first.
- Neither we nor our providers use customer data to train AI models.
04Changes to this list
- We email the administrators of every customer at least 30 days before a new sub-processor starts handling customer data.
- A customer may object in writing during that period, giving its reasons. We will then work with it in good faith to find a solution.
- If we cannot find one, the customer may end the affected part of the service. It will get back any fees it has paid for the period after it ends.
05Transfers outside the EEA
- Some of the providers above are based in the United States, as the table shows.
- For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it. Otherwise we rely on the European Commission’s standard contractual clauses.
- Candidate documents are stored in the EEA. Text from them leaves the EEA only when it is sent for AI evaluation.
Other documents
Terms of service
The agreement between Kermit Tech AS and the organisations using HireOSS.
Privacy policy
How we handle data about the people who use HireOSS.
Data processing agreement
Our obligations as a processor of candidate data.
Candidate privacy notice
For applicants whose CV or interview has been assessed in HireOSS.
Cookie policy
What we store in your browser, and why there is very little of it.