Subprocessors
Last updated October 21, 2026
These are the companies that process personal data for AnswerReel, what each one does, what it receives and where. Each one is bound by its contract with us, and Stripe also uses billing details for its own fraud prevention and legal duties. This list is Annex III of our data processing agreement.
| Provider | What it does | Data it receives | Where | Transfer mechanism |
|---|---|---|---|---|
| Vercel | Hosts the website and the application | Requests and server logs, with links that contain access codes masked | United States (Washington, D.C. region) | Standard Contractual Clauses (Module Three) with the UK Addendum and Swiss changes, in Vercel's DPA. Also certified under the EU-US and Swiss-US Data Privacy Frameworks and the UK Extension, including HR data. |
| Tencent Cloud | Runs the database server | Accounts, candidate names and emails, typed answers, transcripts, scores, summaries, notice records | United States (Ashburn, Virginia) | Tencent Cloud's data processing agreement, which includes the Standard Contractual Clauses (Module Two) with the UK Addendum. It has no Swiss terms. Not certified under the Data Privacy Framework. |
| Mux | Stores, processes and plays back video and audio answers | Video and audio recordings | United States | EU and Swiss data: Standard Contractual Clauses (Module Three) in Mux's DPA, with its Swiss changes. UK data: Mux's certification under the UK Extension to the Data Privacy Framework, which covers HR data. |
| Deepgram | Transcribes audio, only for candidates who allow AI | Audio from answers | United States | No signed data processing agreement yet. Until there is one, Deepgram's standard terms apply, and our requests opt out of its model improvement program. Not certified under the Data Privacy Framework. |
| Anthropic | Writes follow-up questions, scores and summaries, only for candidates who allow AI | Question text, criteria and the words of the answer. Not the video, the audio, or the name and email address the candidate entered. | United States | Standard Contractual Clauses (Module Three) with the UK Addendum and Swiss changes, in Anthropic's DPA. Not certified under the Data Privacy Framework. |
| Cloudflare | Stores uploaded files, database backups and the deletion log | Uploaded files, database backups, IDs of deleted records | United States location requested; not guaranteed by the provider | Certified under the EU-US and Swiss-US Data Privacy Frameworks and the UK Extension, including HR data. Cloudflare's DPA adds Standard Contractual Clauses (Module Three), with the UK Addendum and Swiss changes, if that certification lapses. |
| Resend | Sends email to candidates and customers | Names, email addresses and email content | United States | Standard Contractual Clauses (Module Three) with the UK Addendum and Swiss changes, in Resend's DPA. Its Data Privacy Framework certification covers non-HR data only, so we don't rely on it. |
| Google (Gmail) | Receives email sent to our privacy and support addresses | Whatever senders include, such as names, email addresses and data requests | United States and other countries | No data processing agreement: these addresses forward to a standard Gmail account for now. |
| Stripe | Takes payments from customers | Customer billing details. No candidate data. | United States and other countries | Certified under the EU-US and Swiss-US Data Privacy Frameworks and the UK Extension. Stripe's Data Transfers Addendum adds Standard Contractual Clauses with the UK Addendum and Swiss changes. No candidate data goes to Stripe. |
Not on this list
Services you connect yourself, such as Zapier or your applicant tracking system, are your own choice and receive data on your instructions. They are not our subprocessors.
Changes
We email customers at least 14 days before adding or replacing a subprocessor, so you can object. The date at the top of this page changes whenever the list does. Questions go to privacy@answerreel.com, and our privacy policy explains how candidate data is handled overall.