Sub-processors

ResReader uses a small number of trusted third-party service providers ("sub-processors") to operate its platform. When we process personal data on behalf of a customer (the data controller), these sub-processors may process that data solely to provide their part of the service. Every provider below is bound by a Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) for international transfers, and none of the AI providers use our customers’ data to train their models.

1. AI processing sub-processors

These providers process resume and interview content to generate scores, matches and reports.

• OpenAI, L.L.C. (United States) — AI analysis of resumes, cover letters and follow-up responses. Does not train on API data. Safeguards: DPA, EU–US Data Privacy Framework, SCCs; zero-data-retention available.

• Anthropic, PBC (United States) — AI analysis for CV optimization and information extraction. Does not train on API data. Safeguards: DPA and SCCs included in commercial terms.

• Google LLC — Gemini / Vertex AI (United States, EU region available) — AI processing and fallback. Does not train on paid-API data. Safeguards: Google Cloud DPA and SCCs.

• Pinecone Systems, Inc. (United States, EU region available) — vector search index of resume content used for candidate–job matching. Safeguards: DPA and SCCs; SOC 2 Type II.

2. Infrastructure & operational sub-processors

• Google LLC — Firebase / Google Cloud Platform (United States) — application hosting, database and file storage. Safeguards: Google Cloud DPA and SCCs.

• Stripe, Inc. (United States) — subscription billing and payment processing. Safeguards: DPA and SCCs; PCI-DSS.

• Twilio Inc. (United States) — SMS and phone messaging. Safeguards: standard DPA and SCCs.

3. International data transfers

Because these sub-processors are based in the United States, personal data may be transferred outside the EEA/UK. Each transfer relies on a lawful mechanism — primarily the EU Standard Contractual Clauses (and the EU–US Data Privacy Framework where applicable) — together with appropriate technical and organisational safeguards. Where a provider offers EU data residency, we prefer the EU region.

4. Changes to this list

We keep this page up to date. Before we add or replace a sub-processor that processes customer personal data, we will update this list. Customers can request advance notification of changes via the contact below.

5. Contact

Questions about our sub-processors or data protection practices can be sent to support@resreader.com. This page is provided for transparency and does not by itself constitute a data processing agreement.