Sub-processors
Last updated: June 2, 2026
To provide our platform, SortList shares limited customer data with the third-party service providers listed below. Each sub-processor is bound by a Data Processing Agreement that requires them to handle data with the same level of care we do.
We notify customers at least 30 days in advance of any new sub-processor being added that would materially affect the processing of their data.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, hosting, database, file storage | All customer data (encrypted at rest) | United States (us-east-2) |
| Anthropic | Large language model (Claude) for resume analysis, candidate matching, and AI chat | Resume text, job descriptions, candidate metadata, chat prompts | United States |
| OpenAI | Large language model (GPT) for resume analysis and AI chat | Resume text, job descriptions, candidate metadata, chat prompts | United States |
| Supabase | Authentication, file storage backup | User account information, uploaded files | United States / EU |
| Resend | Transactional email delivery (verification, candidate outreach, notifications) | Email addresses, email content | United States |
| Calendar integration (Google Calendar) and OAuth sign-in | Calendar events, email address, profile name (only when user connects) | United States |
Data minimization
We share only the data required for each sub-processor to perform its specific function. Model providers receive only the text content needed to generate a response — they don't receive your account credentials, billing information, or data from other customers.
AI training
The model providers we use (Anthropic and OpenAI) are contractually prohibited from using customer data to train their models, in line with their enterprise data-processing agreements.
International transfers
Most of our sub-processors are located in the United States. Where data is transferred from the EU or India, we rely on Standard Contractual Clauses (SCCs) and supplementary measures required under GDPR and DPDP.
Questions?
For sub-processor or DPA requests, contact privacy@sortlistnow.com.