Subprocessors
Third-party services that process data on our behalf
Last updated: 14 October 2026
These are the subprocessors that process Customer Personal Data for Cavuno. The list matches Annex III of our Data Processing Agreement.
We email account owners and anyone who signed our DPA at least 7 days before we add or replace a subprocessor, and update this page. See clause 6 of our DPA.
Current subprocessors
The job seeker data column shows whether a subprocessor receives candidate profiles, CVs, applications, job alert subscriptions or job seekers' searches. “Published profiles only” means it can receive candidate profiles a board has made public, and no other job seeker data.
AI model providers are used for the Services' AI features, including site building, CV parsing, search, translation and enrichment.
| Subprocessor | Purpose | Processing location | Job seeker data | Transfer safeguard |
|---|---|---|---|---|
| Convex Convex, Inc. | Primary database and private file storage: candidate profiles, applications and CVs, subscribers, board data, Builder source, support conversations | US (AWS) | Yes | SCCs Module 2 and UK Addendum, deemed executed with Convex's terms |
| Hetzner Hetzner Online GmbH | Application hosting and background processing | United States; entity in Germany | Yes | Hetzner DPA v1.2, concluded 13 Oct 2026, which requires an Article 44 safeguard for Hetzner's US subprocessor; Hetzner states it uses SCCs with Hetzner US LLC |
| Cloudflare Cloudflare, Inc. | Network, CDN, storage and hosting | Global network; storage in US and EEA | Yes | DPF; SCCs Modules 2 and 3 as fallback, incorporated in self-serve terms |
| Stripe Stripe, LLC | Cavuno's own subscription billing. Checkout for employer job posts and paid candidate access runs on the Customer's own connected Stripe account (clause 2.3) | US | No (see clause 2.3 of our DPA) | SCCs Modules 1 to 3 (Data Transfers Addendum), incorporated in Stripe's terms |
| OpenAI | AI processing, including CV parsing | US | Yes | SCCs Modules 2 and 3 and UK Addendum, accepted on use |
| Google Google LLC | Cloud hosting and AI models | United States and other Google locations | Yes | DPF; SCCs in Google's processor terms (Gemini API on a billed project) |
| Voyage AI Voyage AI Innovations, Inc. | Search | US | Yes | SCCs and UK Addendum, deemed signed with Voyage's terms |
| Qdrant Qdrant Solutions GmbH | Search | United States; entity in Germany | Yes | SCCs Modules 2 and 3 for any non-EEA processing |
| PostShiba PostShiba by Bento (Backpack Internet Pty Ltd) | Email delivery | Australia, US, EU | Yes | SCCs and UK Addendum in Bento DPA, accepted with Bento's terms |
| Resend Resend (Plus Five Five, Inc.) | Fallback email delivery | US | Only if used as the fallback, or in support replies | DPF; SCCs Modules 2 and 3 |
| Mapbox Mapbox, Inc. | Location services | US | Yes | DPF; SCCs Modules 2 and 3, deemed signed |
| Tinybird Tinybird, Inc. | Analytics | United States | Yes | SCCs Module 2, agreed in Tinybird's terms |
| Axiom Axiom, Inc. | Logging | US or EU | Yes | SCCs Module 2 and UK clauses, accepted on use |
| Better Stack | Logging and monitoring | EU, US | Yes | SCCs Modules 2 and 3, part of Better Stack's terms |
| Anthropic | AI models for board setup and imports | US | No | SCCs Modules 2 and 3, part of Anthropic's commercial terms |
| xAI xAI (SpaceXAI LLC) | AI models for the website builder, including dictation | US | Published profiles only | SCCs Modules 2 and 3 and UK Addendum, part of Enterprise terms that govern API use |
| TypeSafe AI TypeSafe AI, Inc. | AI checks of imported job data | US | No | SCCs Modules 2 and 3 and UK Addendum, part of TypeSafe's terms |
| Exa Exa Labs, Inc. | Web search for the website builder | US | No | SCCs Modules 2 and 3 and UK Addendum, part of Exa's terms |
| OpenRouter OpenRouter, Inc. | AI model routing for translation and enrichment | US, plus the model hosts' locations | No | SCCs Module 2 and UK Addendum, part of OpenRouter's terms |
| RunInfra RunInfra (RightNow AI, Inc.) | AI model hosting for the website builder and translation | United States; files in Sweden | Published profiles only | SCCs Module 2 and UK Addendum, accepted on use |
| Alibaba Cloud Alibaba Cloud (Singapore) Pte. Ltd. | AI models for the website builder | Singapore | Published profiles only | SCCs Modules 2 and 3 and UK Addendum, deemed entered with the Membership Agreement |
| Xiaomi MiMo Xiaomi Technologies Singapore Pte. Ltd. (MiMo) | AI models for the website builder, enrichment and translation | Singapore, Netherlands | Published profiles only | Processor terms in MiMo service agreement, no SCCs; restricted provider |
| DeepSeek Hangzhou DeepSeek AI Co., Ltd. | AI models for the website builder and job post enrichment | China | Published profiles only | None; restricted provider |
Not subprocessors
Tools Cavuno uses only as controller, integrations and tags the Customer installs itself, and sign-in providers that job seekers choose are not subprocessors.
Change log
- 5 October 2026: Removed DigitalOcean
Retired subprocessors no longer receive data. Past versions of this list are kept in each signed DPA's Annex III.
For more information about how we protect data, see our Security page. For details on what data we collect and how we use it, see our Privacy Policy.