| Amazon Web Services (AWS) | United Kingdom | Primary cloud hosting for Nova. | Candidate and application data, user account data, configuration data, file attachments, logs and backups. | Data stored in the UK. Transfers from the EEA to the UK rely on the EU adequacy decision for the UK; SCCs are used only where adequacy no longer applies or is otherwise required. (Amazon Web Services, Inc.) |
| Vercel Inc. | United Kingdom with global points of presence | Application hosting for Nova web application. | User requests and session data in transit, application runtime data, and deployment metadata. No persistent storage of candidate or application data. | Primary region is the UK. Transfers from the EEA to the UK rely on the EU adequacy decision for the UK; SCCs are used for locations outside the UK/EEA where required. Vercel DPA and trust centre. (Vercel) |
| OpenAI, L.L.C. | United States | AI inference. | Text derived from candidate and job data, and system metadata needed to operate the service. | EU Standard Contractual Clauses and UK IDTA where required; OpenAI DPA and trust portal. (OpenAI) |
| Google Cloud | European Union and United States | AI inference and embeddings. | Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. | EU Standard Contractual Clauses and UK IDTA where required; Google Cloud Data Processing Addendum. (Google Cloud) |
| Mistral AI | European Union | Text extraction from resume documents. | Resume and CV content (documents submitted for processing), extracted text and structured data derived from candidate documents. | Processing in the EEA; Mistral AI’s standard API terms include GDPR provisions. Mistral does not use customer data for model training. (Mistral AI) |
| Fireworks AI, Inc. | United States and European Union | AI inference and embeddings. | Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored. | EU Standard Contractual Clauses and UK IDTA where required; Fireworks AI DPA and trust portal. (Fireworks AI) |
| Baseten Labs, Inc. | United States and European Union | AI inference and embeddings. | Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored. | EU Standard Contractual Clauses and UK IDTA where required; Baseten DPA and trust portal. (Baseten) |
| Together AI, Inc. | United States and European Union | AI inference and embeddings. | Text and embeddings derived from candidate and job data, and system metadata needed to operate the service. Data is processed transiently and not stored. | EU Standard Contractual Clauses and UK IDTA where required; Together AI privacy policy and SOC 2 compliance. (Together AI) |
| OpenRouter, Inc. | United States and European Union | AI inference provider management. | Text derived from candidate and job data, and system metadata needed to operate the service. | EU Standard Contractual Clauses and UK IDTA where required; OpenRouter DPA and trust portal. (OpenRouter) |
| Bandar Systems Inc. (S2) | United States | Durable stream infrastructure for agent chat streaming and resume. | Streamed model output, stream metadata, and session identifiers needed to resume in-flight agent interactions. | Appropriate safeguards for international transfers, including EU Standard Contractual Clauses and UK IDTA where required, under our agreement with S2 and S2’s privacy terms. (S2 Privacy, S2 Terms) |
