Subprocessors
This list is published pursuant to Article 28 of the GDPR and the Data Processing Agreement (DPA). It records all third-party providers (Sub-processors) that PreHire uses to process personal data in the context of providing the Services.
Any update to this list is notified to Clients by email with thirty (30) days' prior notice, in accordance with Article 6.4 of the DPA.
1. Infrastructure and hosting
Google Ireland Limited (Google Cloud Platform / Firebase)
- Role
- Hosting of the Platform, Firestore database, storage of CVs and videos, Firebase Auth services
- Data
- All recruiter account data and Candidate Data
- Location
- europe-west1 region (Belgium) or equivalent EU region
- Parent company
- Alphabet Inc. (United States)
- Safeguards
- Google DPA + EU SCCs 2021/914 + EU-US Data Privacy Framework certification
- Website
- cloud.google.com
2. Artificial intelligence services
OpenRouter Inc.
- Role
- Routing of requests to language models for extracting information from CVs, transcribing video answers and indicative scoring
- Data
- Textual content of CVs, transcriptions of video answers. No biometric data. No raw video.
- Location
- API hosted in the United States; PreHire configures the routing to call only inference models hosted within the European Union
- Safeguards
- EU SCCs 2021/914 + contractual data non-retention policy + prohibition of use for model training
- Website
- openrouter.ai
Note: The OpenRouter configuration is reviewed periodically to maintain the restriction to EU models. PreHire is considering switching to a 100% European inference API (Mistral La Plateforme or equivalent) as part of its ongoing sovereignty approach.
3. Payment
Stripe Payments Europe Limited
- Role
- Payment processing (subscriptions, Credits)
- Data
- Billing and payment data of the Client (recruiter only, never Candidate Data)
- Location
- Ireland (EU headquarters) – processing may involve the United States for the needs of the banking network and fraud prevention
- Parent company
- Stripe, Inc. (United States)
- Safeguards
- Stripe DPA + EU SCCs 2021/914 + EU-US Data Privacy Framework certification
- Website
- stripe.com
4. Transactional emails
Resend, Inc.
- Role
- Sending of transactional emails (account verification, Candidate invitations, notifications, invoices, alerts)
- Data
- Recipient email address, email content, sending metadata
- Location
- United States
- Safeguards
- Resend DPA + EU SCCs 2021/914
- Website
- resend.com
Note: As part of its sovereignty approach, PreHire plans to switch transactional emailing to a French provider (Sweego or equivalent). This update will be notified to Clients thirty (30) days before it takes effect.
5. Professional mailboxes
Zoho Corporation B.V. (Zoho Mail)
- Role
- Professional mailboxes for PreHire teams (contact, support, sales, DPO)
- Data
- Email exchanges between Clients/Candidates and PreHire
- Location
- Netherlands (EU headquarters) with EU infrastructure
- Parent company
- Zoho Corporation Pvt. Ltd. (India)
- Safeguards
- Zoho DPA + EU SCCs 2021/914
- Website
- www.zoho.com
6. Analytics and audience measurement
To be completed
Depending on the tool chosen (recommendation: Plausible Analytics or self-hosted Matomo, exempted from consent by the CNIL).
- Role
- Anonymized audience measurement of the site and the Platform
- Data
- Pseudonymized browsing data
- Location
- To be confirmed depending on the tool chosen
- Safeguards
- To be confirmed
7. No other transfers
PreHire does not use any other sub-processor to process Candidate Data outside the list above.
The data is never:
- sold to third parties;
- used to train artificial intelligence models of PreHire or its sub-processors;
- shared with advertising networks;
- made available to third parties for commercial profiling purposes.
8. Notification of changes
PreHire notifies any addition or change of Sub-processor to Clients:
- by email to the Recruiter account address;
- by updating this list;
- with a minimum of thirty (30) days' notice before the change takes effect.
The Client may object to a change for a legitimate reason related to data protection. In the event of an unresolved objection, the Client may terminate the contract free of charge.
9. Contact
For any question regarding sub-processors or transfer mechanisms: DPO – dpo@pre-hire.com.