1. Status of this list
This list is incorporated by reference into the RecruitiFi Data Processing Agreement and the RecruitiFi Agency Data Processing Addendum, and forms Annex III of each. It also populates Annex III of the 2021 Standard Contractual Clauses where those clauses apply to a transfer, in the version published at the relevant time.
The sub-processors below are authorized to process Personal Data on behalf of RecruitiFi's clients and agency users in connection with the RecruitiFi platform. Each is engaged under a written data processing agreement imposing data protection obligations no less protective than those in the applicable agreement, and RecruitiFi remains fully liable for each sub-processor's performance of those obligations. Transfers to each sub-processor are covered by the corresponding adequacy decision, or, for United Kingdom transfers, the data bridge, for as long as the certification recorded in the Verification column remains active and to the extent the Personal Data falls within the scope of that certification. The 2021 Standard Contractual Clauses are incorporated into each of the agreements below and support the certification. The Transfer safeguard column records, for each sub-processor, how the Clauses engage: expressly, in the case of Cloudflare, on a lapse of certification; and by definition, in the case of Salesforce, Amazon Web Services, and Datadog, whose agreements apply the Clauses to a transfer that is not covered by adequacy. Where that has not been confirmed against the executed agreement, that column indicates as much. RecruitiFi maintains a Clause 14 transfer risk assessment for each recipient.
2. Authorized sub-processors
| Sub-processor (legal entity) | Service provided | Processing location | Transfer safeguard | Verification |
|---|
| Salesforce, Inc. (Heroku) | Application hosting; managed Postgres and Redis data stores | United States (Virginia primary, Oregon disaster recovery) | 2021 SCCs, Modules Two and Three, incorporated at clause 12.3 of the Salesforce Data Processing Addendum (revision April 2026) with the additional terms in Schedule 1; UK transfers under the Approved Addendum (template Addendum B.1.0) at Schedule 1 clause 2.15; Swiss transfers at Schedule 1 clause 2.16. While the DPF certification recorded opposite is active, clause 12.1 excludes transfers to certified Salesforce entities and certified sub-processors from the definition of a Third-Country Transfer, so RecruitiFi treats those transfers as covered by the corresponding adequacy decision. If the certification ceases to be active, clause 12.3 engages and lists the Salesforce Processor Binding Corporate Rules alongside the Clauses. Schedule 1 clause 1.5 provides that the Binding Corporate Rules prevail over the DPA on a conflict, and Schedule 1 clause 2.17 gives the Clauses priority over the DPA body; the agreement does not rank the Binding Corporate Rules against the Clauses. By documented position, assessed by the Data Protection Officer and ratified by the SMT on August 14, 2026, RecruitiFi treats the Clauses as the operative contractual safeguard for this transfer, with the Binding Corporate Rules standing as a supplementary safeguard, consistent with the hierarchy provision at Clause 5 of the 2021 Standard Contractual Clauses (Transfer Mechanism Precedence Position: Salesforce, filed in 09 Vendor and Sub-Processor / 04 Vendor Reviews). | Salesforce Data Processing Addendum, revision April 2026. Pre-signed by Salesforce, Inc. on April 10, 2026 (Docusign envelope 0ACF4B4F-98E0-44B9-9037-8E6F58507730); countersigned by RecruitiFi on June 12, 2026. Data Privacy Framework checked August 6, 2026 against the Salesforce participant record. Salesforce, Inc. and Heroku, Inc. are both listed covered entities. EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all Active; recertification due October 20, 2026. |
| Amazon Web Services, Inc. | Object storage, content delivery, key management, security monitoring | United States | 2021 SCCs: the Controller-to-Processor Clauses (Module Two) where RecruitiFi is a controller and the Processor-to-Processor Clauses (Module Three) where it acts as a processor, incorporated at AWS Service Terms section 1.14.3 and at section 12 of the AWS Data Processing Addendum. UK transfers under the AWS UK GDPR Addendum, which applies the ICO Approved Addendum (template Addendum B.1.0) to those Clauses, and Swiss transfers under the AWS Swiss Addendum, both incorporated at AWS Service Terms section 1.14.4. The AWS Supplementary Addendum, carrying AWS's government-access commitments, is incorporated at section 1.14.2. The Clauses apply to transfers to a Third Country, which the AWS Data Processing Addendum defines by reference to the absence of a European Commission adequacy finding, so while the DPF certification recorded opposite is active the transfer is covered by that adequacy decision and the Clauses stand behind it. | DPA: AWS Data Processing Addendum, copy on file dated July 2023. Confirm the current published version and AWS Data Processing Addendum, together with the UK GDPR Addendum, the Swiss Addendum and the Supplementary Addendum, each incorporated automatically into the AWS Service Terms (version dated July 29, 2026) at sections 1.14.1 to 1.14.4. No signature is required and none is given. Copies retrieved August 6, 2026 and filed in 09 Vendor and Sub-Processor. Data Privacy Framework checked August 6, 2026. Amazon Web Services, Inc. does not hold its own participant record; it is a listed covered entity on the Amazon.com, Inc. record. EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all Active; recertification due January 2, 2027. |
| Cloudflare, Inc. | Edge security, web application firewall, content delivery | Global edge network, transit only. TLS termination and inspection occur at the edge location nearest the requester; nothing is stored at the edge. Origin and all data at rest remain in the United States. See the note on edge processing below. | 2021 SCCs, Modules Two and Three, incorporated at section 6.2(a) of the Cloudflare Data Processing Addendum version 6.4, effective April 3, 2026; UK Addendum (version B1.0) at section 6.2(b); Swiss transfers at section 6.2(c). When engaged, the Clauses apply to Cloudflare's processing wherever it occurs, so they cover inspection at edge locations outside the United States. Under section 6.4, a transfer made under the Data Privacy Framework is not a Restricted Transfer while the certification recorded opposite is active; if it lapses the transfer is immediately deemed Restricted and section 6.2 applies, so the Clauses take effect automatically. See the note on edge processing below. | Cloudflare Data Processing Addendum version 6.4, effective April 3, 2026, forming part of the Cloudflare subscription agreement and effective from the date RecruitiFi accepted it. Acceptance recorded June 12, 2026. Data Privacy Framework checked August 6, 2026 against the Cloudflare, Inc. participant record; no other covered entities. EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all Active; recertification due September 23, 2026. |
| Datadog, Inc. | Centralized logging and security monitoring; in-application web application firewall, account-takeover monitoring, and intrusion detection and prevention with automated blocking. | United States | 2021 SCCs, Modules Two and Three, incorporated at section 10.1 of the Datadog Data Processing Addendum (last updated January 3, 2024); UK Transfer Addendum at section 10.3; Swiss transfers at section 10.2. Section 10 engages the Clauses only where a transfer is not subject to an applicable adequacy decision, so while the DPF certification recorded opposite is active the transfer is covered by that decision and the Clauses stand behind it. | Datadog Data Processing Addendum, last updated January 3, 2024, incorporated into the Datadog Subscription Agreement and effective from that agreement's effective date. Data Privacy Framework re-verified August 8, 2026 against the Datadog, Inc. participant record; no other covered entities. EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all Active — re-verified August 13, 2026 against the participant record; recertification completed; all three frameworks Active; next certification due August 7, 2027. To be re-verified against the participant record once the re-certification completes and in any event immediately before publication. Verification cadence for every row in this list is keyed to the participant’s own recertification date, not a fixed calendar sweep. |
| Stytch, Inc. | End-user authentication | United States | 2021 SCCs in the executed Twilio Data Protection Addendum covering the Stytch services. DPF certification is held by Twilio Inc. with Stytch as a listed covered entity, so while it is active the transfer is covered by the corresponding adequacy decision. Whether the Twilio addendum engages the Clauses only in the absence of adequacy, as the other sub-processor agreements do, has not been confirmed against the executed document. | Twilio Data Protection Addendum covering the Stytch services, executed April 9, 2026. Data Privacy Framework checked August 6, 2026. Stytch holds no independent participant record: it appears only as a covered entity, listed as “Stytch”, on the Twilio Inc. record, so each check reached the correct entity. EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all Active; recertification due April 20, 2027. |
| Intercom, Inc. | In-platform support messenger and support communications for Employer users and Agencies; support conversations may incidentally contain Personal Data raised in a support request. | United States (primary processing facilities), with Intercom affiliates and sub-processors per its published list. | EU-U.S. Data Privacy Framework, UK Extension and Swiss-U.S. DPF certification of Intercom, Inc.: all Active, HR and Non-HR data, no other covered entities; verified 8 August 2026; next certification due November 14, 2026. The Intercom DPA expressly relies on the DPF for restricted transfers, with the 2021 SCCs incorporated as fallback (Modules Two and Three for Customer Personal Data; Module One for Account Data; Irish governing law; UK Addendum; Swiss amendments). | Intercom Data Processing Addendum, effective April 9, 2025, retrieved and filed 8 August 2026; DPF register printout filed 8 August 2026. Contracting entity confirmed as Intercom, Inc. (US-customer entity under the Intercom terms). Sub-processor changes: 20 days’ notice via dataprotection@intercom.io; current list at intercom.com/legal/subprocessors-list/update. |
Note on edge processing (Cloudflare)
Cloudflare sits in front of the RecruitiFi platform as its DNS, web application firewall, DDoS mitigation, bot management and content delivery layer. A request reaches the Cloudflare edge location nearest the requester, where the TLS session is terminated so the traffic can be inspected against RecruitiFi's security rules, and is then forwarded to the platform in the United States. Because Cloudflare operates a single global anycast network, a request from a data subject in the EEA, the United Kingdom or Switzerland is ordinarily inspected at an edge location in that region rather than in the United States.
The personal data involved is limited to request traffic and the requester's IP address, together with the request metadata generated by inspection, for all user categories including unauthenticated site visitors. Candidate records, resumes, account data and platform content are not stored at the edge. The edge holds no data at rest; cacheable public content is served from Amazon CloudFront, and edge event records are forwarded to RecruitiFi's centralized logging platform in the United States.
RecruitiFi operates on Cloudflare's default global edge configuration. Regional Services, the Cloudflare Data Localization Suite feature that confines TLS termination to a chosen region such as the EU or the United States, is an Enterprise add-on and is not enabled on RecruitiFi's account.
On the default configuration, RecruitiFi's position is as follows. Inspection at an edge location outside the United States is transient processing by a sub-processor in the course of delivering the service, and it is covered by the same safeguard as every other transfer to Cloudflare: the 2021 Standard Contractual Clauses incorporated at section 6.2 of the Cloudflare Data Processing Addendum, with the UK Addendum for United Kingdom transfers and the Swiss amendments for Swiss transfers. Those Clauses apply to Cloudflare's processing wherever it is carried out and are not confined to processing in the United States, and Cloudflare's obligations under them extend to its own sub-processors, including its third-party data center operators. While Cloudflare's Data Privacy Framework certification is active, section 6.4 of the Data Processing Addendum provides that a transfer made under the Framework is not a Restricted Transfer, so it is covered by the corresponding adequacy decision; if the certification lapses the transfer is immediately deemed Restricted and the Clauses described above take effect automatically. No personal data is retained outside the United States as a result of edge processing.
3. Notice of changes
RecruitiFi will give at least 30 days’ notice before a new sub-processor begins processing Personal Data, by publishing an updated version of this list with a revised effective date and notifying clients and agency users through the platform or by email to the designated contact. To subscribe to change notifications, contact dpo@recruitifi.com.
A client or agency user with a reasonable, data-protection-based objection to a new sub-processor may object within the notice period, in accordance with Section 6.3 of the applicable agreement. Superseded versions of this list are retained and provided on request, so that the version in force at any given date can be established.
4. Version history
| Version | Effective date | Change | Notice given |
|---|
| 1.0 | September 17, 2026 | Initial publication of the RecruitiFi Sub-Processor List as Annex III to the RecruitiFi client Data Processing Agreement and the Agency Data Processing Addendum. No change to the sub-processors previously listed in those documents. | Not applicable |
5. Processors that are not sub-processors
RecruitiFi engages the processors below for its own purposes as a controller. They do not process Candidate Personal Data or data processed on the instructions of a Client or an Agency, and are therefore not sub-processors under either agreement. Stripe and Airwallex process the personal data of Agency users who receive payouts (payee name, bank account details, and tax identification data): That data is collected by the provider directly from the payee through its own onboarding process and is never received or held by RecruitiFi. Each provider is an independent controller of it, for payment execution, sanctions screening, anti-money-laundering and know-your-customer checks, fraud monitoring, and tax and regulatory reporting, which each determines for itself, under its own privacy notice. RecruitiFi's only disclosure to a provider is the instruction to pay: the provider's account reference for the Agency and the amount, of which RecruitiFi is controller. Neither provider acts on RecruitiFi's instructions with respect to the payee's own data, so neither is a processor of RecruitiFi for that purpose. Each does act as RecruitiFi's processor for the payout instruction itself: the Stripe Data Processing Agreement incorporates Modules One and Two of the 2021 Standard Contractual Clauses, and the Airwallex Data Processing Addendum of 22 July 2026 applies Module One to the data it processes as independent controller and Module Two to Instructions Data, which it defines as the Airwallex Account ID and the associated payment execution instructions. Employer fee collection is a separate matter and does not involve any disclosure of personal data by RecruitiFi: see the note below. They are listed here for transparency.
Employers remit fees to RecruitiFi by ACH or wire transfer into a virtual account held in RecruitiFi’s name. RecruitiFi transmits no Employer, Agency, or Candidate Personal Data to the account provider for that purpose, and gives it no instruction to process any. Any remitter details carried in the payment message originate from the Employer’s own bank, and the account provider handles them as a financial institution under its own legal obligations, exactly as any bank receiving an inbound payment would. Fee collection is therefore not a processing relationship between RecruitiFi and the provider at all, and is out of scope of both the client DPA and the Agency DPA. For the U.S. service, the account is held with Evolve Bank & Trust, Member FDIC. Under the Airwallex Sponsored Program described in the executed Single Geo Master Services Agreement dated 18 May 2026, Evolve Bank & Trust is the licensed financial institution and Airwallex US, LLC (NMLS #1928093) acts as its service provider and program manager. Airwallex (Hong Kong) Limited is also a contracting party to that agreement and provides the Treasury Management service under it.
| Processor | Purpose | Status |
|---|
| Stripe, LLC | Platform payout transactions (Agency payouts) | Independent controller of the payee data it collects directly from the Agency, for payment execution, sanctions screening, anti-money-laundering and know-your-customer checks, and regulatory reporting. RecruitiFi supplies only the payout instruction, being the provider's account reference and the amount, and is controller of that. Not a processor of RecruitiFi for the payee's own data, but is RecruitiFi's processor for the payout instruction under its data processing terms. Not a sub-processor of Client or Agency Personal Data. |
| Airwallex US, LLC | Agency payout transactions. Also provides the virtual account into which Employers remit fees; that function involves no disclosure of Personal Data | Independent controller of the payee data it collects directly from the Agency, for payment execution, sanctions screening, anti-money-laundering and know-your-customer checks, and regulatory reporting. RecruitiFi supplies only the payout instruction, being the provider's account reference and the amount, and is controller of that. Not a processor of RecruitiFi for the payee's own data, but is RecruitiFi's processor for the payout instruction under its data processing terms. Not a sub-processor of Client or Agency Personal Data. |
| Google LLC (Google Analytics) | Website analytics on RecruitiFi marketing properties, subject to cookie consent | RecruitiFi acts as controller. Not a sub-processor of Client or Agency Personal Data. |
| Google LLC (Google Workspace) | Corporate identity (SSO and MFA) for RecruitiFi staff, internal email, and document collaboration; staff correspondence may incidentally contain personal data relating to platform support | RecruitiFi acts as controller. Not a sub-processor of Client or Agency Personal Data. Protected under the executed Google DPA (2021 SCCs; DPF certification brings the transfer within the corresponding adequacy decision while active and within Google LLC's certified scope). The executed Google terms have not been reviewed against this position. |
Questions about this list, requests for superseded versions, and requests for the executed sub-processor agreements should be directed to the RecruitiFi Data Protection Officer at dpo@recruitifi.com, or by post to RecruitiFi, Inc., 21 West 46th St., New York, NY 10036.
