Sub-processors

List version 2026-05-07. We notify customers of material changes (additions, removals, jurisdictional changes) at least 30 days before they take effect.

A sub-processor is a third-party service we engage to help us deliver Basanite. Before processing live customer data we execute a Data Processing Agreement (DPA) with each sub-processor that contractually requires them to handle personal data only on our documented instructions and to apply at least the security standards we apply. Per-provider DPA status is shown below.

Supabase Inc.

Primary database, authentication, and storage (interview recordings)

Data shared: All structured data: candidate name/email, CV text, transcripts, scores, reports, recordings, account credentials
Region: AWS us-east-1 (United States)
Transfer mechanism: UK Extension to the EU-US Data Privacy Framework + SCCs
DPA status: Standard DPA available; will be executed prior to processing live customer data

Anthropic, PBC

AI inference — CV extraction, interview agent, dimension scoring, report generation

Data shared: CV text, interview transcripts (in-flight only), role configuration. Anthropic does not retain or train on data by default and Basanite has not opted in to any training programme.
Region: United States
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

ElevenLabs Inc.

Conversational voice agent that conducts the live interview

Data shared: Live audio stream during the interview. ElevenLabs may retain conversation logs for a short debugging window per their terms.
Region: United States
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

Merge.dev, Inc.

Unified ATS API — pulls candidate applications from Greenhouse, Lever, Ashby etc. and pushes results back

Data shared: ATS-linked-account tokens (encrypted), candidate names/emails, CV attachments, assessment results
Region: United States
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

Resend, Inc.

Transactional email delivery (invites, feedback reports, ops alerts)

Data shared: Recipient email address, candidate name, role title, feedback report content
Region: United States
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

Vercel Inc.

Frontend hosting + edge network

Data shared: Request metadata (IP, user-agent, path) for the marketing site and dashboard. No application personal data is processed by Vercel functions in this deployment.
Region: Global edge; primary US
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

Render Services Inc.

Backend hosting (FastAPI service that orchestrates AI calls)

Data shared: In-flight: all candidate and hirer data passes through this service. At rest: 30-day rolling logs (PII-scrubbed by application code).
Region: AWS us-east (United States)
Transfer mechanism: Standard Contractual Clauses (SCCs)
DPA status: Standard DPA available; will be executed prior to processing live customer data

Questions about a specific sub-processor or to request a copy of an executed DPA: privacy@basanite.co.uk.