Third parties that may process personal data on behalf of Axion Connect to provide HR Assist. Workspace administrators are notified at least fourteen days before a new sub-processor is added (DPA section 7), and may object on reasonable grounds within that period. Where a workspace supplies its own keys or account for a provider, that provider acts under the workspace's own contract and is marked customer-supplied. Each sub-processor is bound by written data-protection terms no less protective than our DPA; the transfer mechanism column names the safeguard for data leaving the EEA, UK or Switzerland.
Infrastructure and security
| Provider | Service | Data | Location | Transfer mechanism | Terms |
|---|---|---|---|---|---|
| Railway Corp. | Application hosting and the PostgreSQL database | All platform data at rest | United States | SCCs | https://railway.com/legal/dpa (opens in a new tab) |
| Clerk, Inc. | Sign-in and user management (when enabled) | Workspace user identity, email, sign-in events | United States | EU-US DPF; SCCs | https://clerk.com/legal/dpa (opens in a new tab) |
| Functional Software, Inc. (Sentry) | Error and uptime monitoring (when enabled) | Stack traces, request routes and timings. Request bodies, cookies, identities, recordings and link credentials are removed before anything is sent; no session replay | United States | EU-US DPF; SCCs | https://sentry.io/legal/dpa/ (opens in a new tab) |
AI models
| Provider | Service | Data | Location | Transfer mechanism | Terms |
|---|---|---|---|---|---|
| OpenRouter, Inc. (routing to DeepSeek, Qwen and other model providers as configured) | Résumé parsing, fitment scoring, interview-question generation, evaluation of transcripts, email drafting | Résumé contents, job descriptions, interview transcripts (identifiers removed before scoring where the workspace enables anonymisation) | United States; model providers may be elsewhere | SCCs | https://openrouter.ai/privacy (opens in a new tab) |
| OpenAI, L.L.C. | Same, where configured; text-to-speech for AI-assisted rounds | As above | United States | EU-US DPF; SCCs | https://openai.com/policies/data-processing-addendum (opens in a new tab) |
| Anthropic, PBC | Same, where configured | As above | United States | EU-US DPF; SCCs | https://www.anthropic.com/legal/commercial-terms (opens in a new tab) |
| Mistral AI | Speech recognition (Voxtral), where configured | Interview audio | France (EU) | Within the EEA | https://mistral.ai/terms (opens in a new tab) |
| Deepgram, Inc. | Speech recognition, where configured | Interview audio | United States | SCCs | https://deepgram.com/dpa (opens in a new tab) |
| Alibaba Cloud (Qwen), via OpenRouter | Speech recognition and transliteration, where configured | Interview audio; transcripts | Per OpenRouter routing | SCCs (through OpenRouter) | https://openrouter.ai/privacy (opens in a new tab) |
None of these providers may use the data to train models. A workspace may replace any of them with its own provider key (customer-supplied), in which case no data reaches the platform's own provider account.
Code execution (coding tests)
| Provider | Service | Data | Location | Transfer mechanism | Terms |
|---|---|---|---|---|---|
| OneCompiler (Onecompiler Technologies) | Runs candidate code and test-case inputs in an isolated sandbox | Candidate source code and test inputs; no candidate identity | United States / India (per provider) | SCCs; no identifiers transferred | https://onecompiler.com/privacy (opens in a new tab) |
| Compiler Explorer (godbolt.org) and Wandbox | Fallback execution only when the primary is unavailable | As above | United States / Japan | No identifiers transferred | https://godbolt.org/#privacy (opens in a new tab) |
| Self-hosted Piston sandbox, where the platform operates one | Same, on infrastructure the platform controls | As above | Platform's region | Not a transfer | — |
Communications
| Provider | Service | Data | Location | Transfer mechanism | Terms |
|---|---|---|---|---|---|
| Resend, Inc. | Transactional email delivery and inbound webhooks | Recipient addresses, message bodies | United States | EU-US DPF; SCCs | https://resend.com/legal/dpa (opens in a new tab) |
| Telnyx LLC | WhatsApp message delivery and delivery receipts | Phone numbers, message bodies | United States | SCCs | https://telnyx.com/privacy-policy (opens in a new tab) |
| Google LLC (customer-supplied) | Calendar, Google Meet rooms, Gmail sending when connected | Meeting metadata, attendee emails, mail sent from the workspace's own account | Per Google's terms | The workspace's own Google contract | https://cloud.google.com/terms/data-processing-addendum (opens in a new tab) |
| Microsoft Corporation (customer-supplied) | Calendar, Teams rooms and recordings, Microsoft 365 mail when connected | Meeting metadata, recordings, mail sent from the workspace's own account | Per Microsoft's terms | The workspace's own Microsoft contract | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA (opens in a new tab) |
Sourcing
| Provider | Service | Data | Location | Transfer mechanism | Terms |
|---|---|---|---|---|---|
| Serper (serper.dev) | Web search used by the candidate-sourcing feature | Search queries derived from a job description; no candidate data is sent | United States | No personal data transferred | https://serper.dev/privacy (opens in a new tab) |
Not used
For clarity: there is no advertising network, no third-party analytics or session-recording tool (no Google Analytics, Microsoft Clarity, Hotjar or similar), and no payment processor holding card details at this time. The error-monitoring vendor above receives stack traces with personal data scrubbed — never résumés, code, recordings, identities or link credentials. This section is updated when that changes.
Transfer safeguards
Transfers from the EEA, UK and Switzerland rely on the EU Standard Contractual Clauses (2021/914) with the UK Addendum and Swiss amendments, incorporated by the DPA, or on the EU-US Data Privacy Framework where the provider is certified. Transfers from India comply with DPDP §16.
Questions: privacy@axionconnect.com
Questions about this document?
Write to privacy@axionconnect.com for anything about data and privacy, or support@axionconnect.com for the agreement itself. We reply within one working day.