Subprocessors

Last reviewed: 2026-08-05

Zero Hiring, Inc. ("Zero Hiring") uses the third-party subprocessors listed below to help provide our AI-powered recruitment platform. A subprocessor is a third party we engage that may process personal information (including candidate and employer data) on our behalf. This page is referenced by our Privacy Policy and our Data Processing Agreement (DPA).

We enter into a data processing agreement, security addendum, or equivalent written commitment with each subprocessor before it processes personal information on our behalf.

How we notify you of changes

When we intend to add a new subprocessor or replace an existing one that will process customer or candidate personal information, we give customers at least 30 days' advance notice before the change takes effect and an opportunity to object, consistent with our Data Processing Agreement.

Notice is given by (a) updating the change log below and the "Last reviewed" date on this page, and (b) emailing the primary account contact on file for each affected customer. You can also track changes directly via our subprocessor change RSS feed, or subscribe to updates by emailing privacy@zerohiring.com. To object to a change, contact the same address before the change's effective date.

Current subprocessors

Subprocessor	Service provided	Data categories processed	Location
Amazon Web Services (AWS)	Cloud infrastructure hosting (compute, storage, secrets management), and AI model inference via Amazon Bedrock for interview scoring, resume assessment, and candidate sourcing	All account, candidate, and interview data (infrastructure layer); resumes, interview transcripts, and job descriptions specifically pass through Bedrock for AI model inference	United States
Neon	Managed PostgreSQL database hosting	All application data (primary database)	United States
Vercel	Frontend application hosting	Application traffic, including candidate and employer data in transit	United States
Anthropic	AI model inference for the Jenny assistant, which runs as a Claude Managed Agent behind both the Slack bot and in-app chat; plus a read-only, per-session token-accounting call used for cost rollup	Jenny conversation content, including any images attached to a message and any candidate, job, or employer data that Jenny surfaces into a conversation on the user’s behalf; session identifiers for token accounting	United States
OpenAI	AI models for interview and resume processing	Resumes, interview transcripts, job descriptions	United States
Mistral AI	Document OCR and resume text extraction	Resume documents and extracted text	United States / European Union
People Data Labs	Candidate sourcing and contact enrichment	Candidate contact details and professional profile data	United States
ZeroBounce	Email deliverability verification for candidate outreach campaigns	Candidate email addresses (validated before an outreach send)	United States
Loxo	Applicant tracking system (ATS) sync	Candidate, application, and pipeline-stage data	United States
Greenhouse	Applicant tracking system (ATS) sync	Candidate, application, and pipeline-stage data	United States
Merge	Unified ATS integration layer for RPO client connections — provisioned, not yet live. No client has a connected Merge integration and no API credential is configured in any environment today	None to date. Will carry candidate and application data routed through connected ATS systems once a client connection is configured	United States
Firecrawl	Website scraping used to brief the AI interview agent on a company	Publicly available employer/RPO-client website content	United States
Logo.dev	Company logo lookup by domain for employer and RPO client branding	Employer/RPO-client website domain names	United States
LiveKit	Real-time audio/video infrastructure for AI interviews	Interview audio/video streams and transcripts	United States
Anam	AI video interview avatars (alternate provider)	Interview video/audio and generated avatar responses	United States
Telnyx	Carrier behind LiveKit's SIP trunking for phone-based interviews. Telnyx is LiveKit's sub-processor for regional call routing — Zero holds no direct Telnyx credential and makes no direct Telnyx API call	Phone numbers, call audio and metadata, carried via LiveKit's SIP trunks	United States
Twilio SendGrid	Transactional and candidate outreach email delivery	Email addresses and message content	United States
Slack	Jenny assistant bot and team notifications	Employer team messages; candidate data may appear in Jenny conversations	United States
Linear	Issue tracking; receives user-submitted in-app product feedback	Submitter email address and free-text feedback content	United States
Google Workspace	Gmail and Calendar API access for connected recruiter mailboxes and interview scheduling	Recruiter email and calendar data for connected accounts	United States
Stripe	Billing and payment processing	Billing contact information and payment data	United States
WorkOS	Authentication for the zero CLI device-code login and the public MCP server’s OAuth connector flow; not used for employer web-dashboard login, which offers only Credentials and Google OAuth	CLI/MCP authentication data	United States
SignWell	Offer letter e-signature	Offer letter content and signer PII	United States
Sentry	Application error monitoring	Error diagnostic data, which may incidentally include PII in stack traces or request context	United States
Amplitude	Product usage analytics and session replay for the web app	Opaque user/employer IDs, product usage event names and properties, and masked session-replay recordings (candidate names, emails, resumes, and interview content are excluded by design)	United States
Infinity Observability	Monitoring and tracing for AI-agent task execution (cost, performance, quality)	Opaque task, interview, and application identifiers plus generic AI-agent task descriptions (no raw candidate or interview content by design)	United States
Cloudflare	DNS and network edge services	Network/DNS request metadata	United States

Change log

2026-08-08 — Corrected the WorkOS description: it authenticates the `zero` CLI and the public MCP server’s OAuth connector flow, not employer web-dashboard login, which uses only email/password or Google sign-in.
2026-08-05 — Removed two entries that described processing that does not happen: Google (Gemini API), which has no integration anywhere in the codebase, and Hugging Face, which is used only to download open-weight model checkpoints that run as a self-hosted artifact -- no candidate or resume content is ever sent to either vendor.
2026-07-29 — Corrected several entries for accuracy: AI model inference is now disclosed on both paths that run it — Amazon Bedrock (resume assessment, interview scoring, sourcing) under AWS, and Anthropic for the Jenny assistant, which runs as a managed agent and therefore processes conversation content; Merge is provisioned but not yet processing any client data; and Telnyx is described as the sub-processor of LiveKit that it is, not a direct integration.
2026-07-25 — Published the initial public subprocessor register, listing every subprocessor currently engaged to process customer or candidate personal information on our behalf.

Questions

For questions about this list or our subprocessor practices, contact privacy@zerohiring.com.