Sub-Processors and International Data Transfers

Last updated: 2026-10-09

1. Overview

This page lists the third-party sub-processors that DWEET LTD (“Dweet”, “we”) uses to provide Nova. Details of data categories, legal bases, security measures, transfer mechanisms and AI training posture are set out in:

Those documents take precedence for any data protection or transfer questions. This page is incorporated by reference into our Terms of Service and Data Processing Agreement and forms part of our description of processing and international data transfers.

2. Changes and notifications

We may add or remove sub-processors as we operate and improve Nova.

We aim to provide at least 7 days’ notice for material changes to this list, except in emergencies.
We update this page when sub-processors are added or removed.
To subscribe to change notifications, email privacy@dweet.com.

Any rights to object to a new sub-processor and related remedies are governed by the DPA.

3. Current sub-processors

3.1 Primary infrastructure and AI processing

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Amazon Web Services (AWS)	United Kingdom	Cloud hosting.	Candidate, job and user account data, file attachments, logs and backups.	Data stored in the UK under the EU adequacy decision; SCCs where required. (AWS)
Vercel Inc.	United Kingdom with global points of presence	Web application hosting.	User requests and session data in transit; no persistent storage of candidate data.	Primary region is the UK under the EU adequacy decision; SCCs where required; Vercel DPA. (Vercel)
OpenAI, L.L.C.	United States	AI inference.	Text derived from candidate and job data, and system metadata needed to operate the service.	EU Standard Contractual Clauses and UK IDTA where required; OpenAI DPA and trust portal. (OpenAI)
Google Cloud	European Union and United States	AI inference and embeddings.	Text and embeddings derived from candidate and job data, and system metadata needed to operate the service.	EU Standard Contractual Clauses and UK IDTA where required; Google Cloud Data Processing Addendum. (Google Cloud)
Mistral AI	European Union	Text extraction from resumes.	Resume content and text extracted from it.	Processing in the EEA. Mistral does not train models on customer data. (Mistral AI)
Fireworks AI, Inc.	United States and European Union	AI inference and embeddings.	Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored.	EU Standard Contractual Clauses and UK IDTA where required; Fireworks AI DPA and trust portal. (Fireworks AI)
Baseten Labs, Inc.	United States and European Union	AI inference and embeddings.	Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored.	EU Standard Contractual Clauses and UK IDTA where required; Baseten DPA and trust portal. (Baseten)
Together AI, Inc.	United States and European Union	AI inference and embeddings.	Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored.	EU Standard Contractual Clauses and UK IDTA where required; Together AI privacy policy and SOC 2 compliance. (Together AI)
OpenRouter, Inc.	United States and European Union	AI inference provider management.	Text derived from candidate and job data, and system metadata needed to operate the service.	EU Standard Contractual Clauses and UK IDTA where required; OpenRouter DPA and trust portal. (OpenRouter)
Bandar Systems Inc. (S2)	United States	Streaming of AI responses.	Streamed AI output and session identifiers.	EU Standard Contractual Clauses and UK IDTA where required; S2 terms. (S2)

Note: For Third-Party AI Services, we configure providers so that Customer Personal Data is not used to train their own general models, as described in our AI Terms and DPA.

3.2 Task processing and automation

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Trigger.dev (API Hero Ltd)	European Union (Germany) and United States	Background job processing.	Candidate and job data needed to run background jobs, and job logs.	EU Standard Contractual Clauses and UK Addendum where required; Trigger.dev DPA. (Trigger.dev)

3.3 Search and data enhancement (optional)

Used only where the relevant feature is enabled.

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Exa Labs Inc.	United States	Web search for company and market research.	Company names, role titles and similar search terms; no resume content.	EU Standard Contractual Clauses and UK Addendum where required; Exa DPA. (Exa)
OpenCage Data	Europe	Geocoding.	Location strings from job and candidate records.	EU Standard Contractual Clauses and UK IDTA where required. (OpenCage)

3.4 Monitoring and analytics

These providers receive telemetry, logs and analytics data that may include limited personal data where necessary to operate, secure, and improve Nova.

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Datadog, Inc.	Europe	Application monitoring.	System metrics and logs, which may include personal data.	EU Standard Contractual Clauses and UK IDTA where required; Datadog DPA. (Datadog)
PostHog Inc.	Europe	Product analytics.	Nova user interaction data (page views, clicks, feature usage); no candidate content.	Processing in the EEA; no restricted transfer.
Sentry, Inc.	Europe	Error tracking.	Error events and diagnostic data, which may include user identifiers; no resume content.	EU Standard Contractual Clauses and UK IDTA where required; Sentry DPA.

3.5 Payment processing

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Stripe, Inc.	European Union, United Kingdom and United States	Payments and billing.	Billing contact details, tokenised payment details and invoice data.	EU Standard Contractual Clauses and UK IDTA; Stripe DPA.

3.6 Development and collaboration

These tools are used for internal development and deployment workflows and handle limited customer-related metadata only.

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
GitHub, Inc. (Microsoft)	European Union and United States	Source code hosting.	Source code; limited personal data may appear in commits or issues.	EU Standard Contractual Clauses and UK IDTA; Microsoft/GitHub DPA.

3.7 Email delivery

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Resend, Inc.	United States and European Union	Transactional email.	Recipient email addresses, names and email content.	EU Standard Contractual Clauses and UK IDTA where required; Resend DPA. (Resend)

3.8 Outreach, messaging, and LinkedIn Recruiter integration (optional)

Used only where customers enable outbound messaging and/or connect LinkedIn Recruiter to Nova.

Sub-processor	Location of processing	Purpose / services	Categories of personal data processed	Transfer mechanism (if applicable)
Unipile SAS	France (European Union). Unipile’s network routing providers, some outside the EEA, may handle connection traffic.	Outreach messaging and an independent LinkedIn Recruiter integration that performs actions requested by the connected user.	LinkedIn session tokens, candidate names, profile details and message content needed for outreach and shortlist export.	Core hosting in the EEA. Restricted onward transfers must comply with DPA Section 9 and Annex IV. Contact `privacy@dweet.com` for information about the applicable transfer safeguards. (Unipile)

Get Started

Scoring

Setup & Settings

More Capabilities

Outbound Search

ATS Integrations

Sourcing Integrations

Account & Billing

Legal

Sub-Processors and International Data Transfers

1. Overview

2. Changes and notifications

3. Current sub-processors

3.1 Primary infrastructure and AI processing

3.2 Task processing and automation

3.3 Search and data enhancement (optional)

3.4 Monitoring and analytics

3.5 Payment processing

3.6 Development and collaboration

3.7 Email delivery

3.8 Outreach, messaging, and LinkedIn Recruiter integration (optional)

​1. Overview

​2. Changes and notifications

​3. Current sub-processors

​3.1 Primary infrastructure and AI processing

​3.2 Task processing and automation

​3.3 Search and data enhancement (optional)

​3.4 Monitoring and analytics

​3.5 Payment processing

​3.6 Development and collaboration

​3.7 Email delivery

​3.8 Outreach, messaging, and LinkedIn Recruiter integration (optional)

1. Overview

2. Changes and notifications

3. Current sub-processors

3.1 Primary infrastructure and AI processing

3.2 Task processing and automation

3.3 Search and data enhancement (optional)

3.4 Monitoring and analytics

3.5 Payment processing

3.6 Development and collaboration

3.7 Email delivery

3.8 Outreach, messaging, and LinkedIn Recruiter integration (optional)