Compliance

Subprocessors

Third-party services Evalgist BV relies on to operate evalgist.ai and the live Evalgist Shortlist product, covering hosting, authentication, document storage, AI processing, payments, and analytics. AI providers do not retain customer documents. Material changes are communicated to active customers at least 30 days in advance.

Vercel

active

Vercel Inc.

Purpose: Application hosting, edge delivery, and build infrastructure.
Location: United States (HQ), with edge presence in Europe.
Data residency: Application code and cached responses on EU edge nodes when reached from EU.
Privacy: vercel.com/legal/privacy-policy

Cloudflare

active

Cloudflare, Inc.

Purpose: Authoritative DNS and domain-name management for evalgist.ai.
Location: United States (HQ), with a global anycast DNS network.
Data residency: DNS query data may be processed on Cloudflare's global anycast network, including outside the EU, under Cloudflare's DPA and transfer safeguards. Application traffic is served directly by Vercel and does not pass through Cloudflare.
Privacy: www.cloudflare.com/privacypolicy

Clerk

active

Clerk, Inc.

Purpose: Authentication, identity, sessions, and shared Evalgist account management.
Location: United States.
Data residency: Account and authentication data stored in the United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed).
Privacy: clerk.com/legal/privacy

Supabase

active

Supabase Inc.

Purpose: Product database, file storage, and auth-adjacent RLS data layer.
Location: Singapore (HQ); EU project hosted in Ireland (eu-west-1).
Data residency: Customer data is stored in EU product projects (Ireland, eu-west-1).
Privacy: supabase.com/privacy

OpenRouter

active

OpenRouter, LLC

Purpose: AI model routing for product document analysis with zero data retention enabled.
Location: United States.
Data residency: Customer document prompts are routed with zero data retention.
Privacy: openrouter.ai/privacy

Resend

active

Resend (Plus Five Five, Inc.)

Purpose: Transactional email delivery and waitlist contact storage.
Location: United States (San Francisco, CA); email dispatch from EU region (eu-west-1, Ireland).
Data residency: Sending: EU. Account data, metadata, logs, and Audiences contact storage: United States, under EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed).
Privacy: resend.com/legal/privacy-policy

Proton

active

Proton AG

Purpose: Email hosting for Evalgist company mailboxes used for product, billing, legal, security, and privacy correspondence.
Location: Switzerland.
Data residency: Customer correspondence and related mail metadata are processed in Switzerland, which has an EU adequacy decision.
Privacy: proton.me/legal/privacy

Stripe

active

Stripe Payments Europe Limited

Purpose: Payment processing for credit purchases.
Location: Ireland (EU).
Data residency: EU.
Privacy: stripe.com/privacy

Silvasoft

active

Silvasoft B.V.

Purpose: Accounting and invoice generation for credit purchases. Receives invoice data when a Stripe checkout completes; no resume or exam content.
Location: Netherlands (EU).
Data residency: EU.
Privacy: www.silvasoft.nl/privacy

PostHog

active

PostHog Inc., EU cloud

Purpose: Cookieless, non-persistent product analytics for manual pageviews and waitlist funnel measurement. Captures email domain on signup, not raw email. No payment data, no resume or exam content.
Location: United States (HQ); EU cloud at eu.posthog.com.
Data residency: EU.
Privacy: posthog.com/privacy

Sentry

active

Functional Software Inc., operating as Sentry

Purpose: Error monitoring and performance tracing across platform apps. Captures stack traces and request metadata; PII routes are excluded and Session Replay is disabled platform-wide.
Location: United States (HQ); EU region used (ingest.de.sentry.io).
Data residency: EU.
Privacy: sentry.io/privacy

Questions? Email legal@evalgist.ai.

Last updated 2026-06-28