AceHR · Legal & privacy
Subprocessors
The service providers that process personal information for AceHR, what they do, the data involved and where they operate.
Last updated:
1. About this list
AceHR uses the service providers below to host, secure and operate the Services. When we process customer workspace data, they act as our subprocessors, and we require them by contract to protect the data and use it only to provide their services to us. Optional providers process data only when the related feature is enabled or connected.
The location column shows where the provider is based and, where we control it, where we have configured processing. Some providers may also process data in other countries under their own terms. We host the Services in the United States.
2. Infrastructure, accounts, billing and email
These providers support every workspace.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Google Cloud | Application hosting (Cloud Run), PostgreSQL database (Cloud SQL), file and recording storage (Cloud Storage), encryption keys (Cloud KMS), secrets and logs. | All workspace and account data, uploaded files, assessment and interview recordings, and logs. | United States |
| Clerk | Sign-in, sessions, organization membership and invitations. | Name, email address, optional phone number, profile photo, sign-in identifiers, organization roles, and session, device and IP information. | United States |
| Cloudflare | DNS for acehr.ai and its subdomains. | Domain name lookups; no workspace content. | Global network |
| Stripe | Subscriptions, checkout, invoices and the billing portal. | Billing contacts, organization details, payment methods (held by Stripe), invoices and payment status. | United States |
| Resend | Delivery of transactional email, including invitations, assessment invitations and notifications. | Recipient names and email addresses, message content and delivery status. | United States |
3. AI providers
AceHR selects the provider for each AI task. See the AI Transparency Notice for how each feature uses AI.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Anthropic | AI processing with Claude models, our primary provider. | Content needed for each AI task, such as job descriptions, résumés, application answers, workspace records, assessment work and transcripts. | United States |
| OpenAI | AI processing, text embeddings for search, and speech-to-text transcription of recorded assessment explanations. | Content needed for each AI task, such as job descriptions, résumés, application answers, workspace records, assessment work and transcripts. Recorded explanation segments for transcription. | United States |
| Google (Gemini API) | AI processing with Gemini models. | Content needed for each AI task, such as job descriptions, résumés, application answers, workspace records, assessment work and transcripts. | United States |
4. Feature providers
These providers process data only when the related feature is used.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Persona Identities, Inc. | Identity verification before an assessment, when the hiring company requires it. | Government ID images, selfie and face-match data, collected by Persona in its hosted flow. AceHR receives only the inquiry status and an inquiry reference. | United States |
| Stripe Identity | Alternative identity verification before an assessment, used only where it is configured instead of Persona. | Government ID images, selfie and face-match data, collected by Stripe in its hosted flow. AceHR receives only the result status and a session reference. | United States |
| IPinfo | Network context at the start of a proctored assessment. | IP address; returns an approximate country and VPN, proxy or hosting indicators. | United States |
| Retell AI | AI voice and browser interviews, including call recording and transcription. | Name, phone number, interview questions and context, call audio and transcripts. | United States |
| DocuSeal | Electronic signatures. | Signer names and email addresses, documents, signatures and signing events. | United States |
| Coresignal | Professional-profile corroboration that a recruiter requests. | A profile URL the candidate supplied or confirmed, and the public professional-profile data returned, such as names, employers, titles and dates. | European Union (Lithuania) |
| Nylas (optional) | Mailbox and calendar sync when a user connects an account. | Email messages, contacts and calendar events in the connected account, and access tokens. | United States |
| Twilio (optional) | Text messages, when SMS is enabled. | Phone numbers, message content, and delivery and opt-out status. | United States |
| Google Analytics (opt-in) | Website analytics on public pages, only after a visitor accepts it. | Cookie identifiers, page views, device and browser information, and IP address. | United States |
5. Services a customer or user connects
When a customer or user connects one of the services below under its own account, the provider processes data under that customer’s or user’s agreement with it. AceHR exchanges only the data needed for the connection.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Google Calendar and Google Meet | Scheduling interviews and creating meeting links. | Attendee names and email addresses, event times and meeting links. | Under the customer’s or user’s account |
| Microsoft Outlook and Microsoft Teams | Scheduling interviews and creating meeting links. | Attendee names and email addresses, event times and meeting links. | Under the customer’s or user’s account |
| Cisco Webex | Scheduling interview meetings. | Attendee names and email addresses, event times and meeting links. | Under the customer’s or user’s account |
| Cal.com | Booking links and scheduling. | Attendee names and email addresses and booking times. | Under the customer’s or user’s account |
| Retell AI (customer account) | AI interviews run under a customer’s own Retell account. | Interview data as described above. | Under the customer’s account |
6. What is not on this list
Code written in assessments runs in an isolated code-execution sandbox operated for AceHR without internet access, not in a third-party code service. The models for on-device face and object detection are served from AceHR and run in the candidate’s browser, so that analysis does not involve any provider. The software can also support DeepSeek as an alternative AI provider, but it is not enabled for the Services, and we will add any provider to this list before it processes customer data.
7. Changes and objections
We update this page when we add or replace a subprocessor, and the date above shows the latest version. Customers with a data processing agreement receive any advance notice it provides and may object as it allows; if we cannot reasonably address an objection, the customer’s remedies are those in its agreement. Questions about this list can be sent to acehrassociatesinc@gmail.com.