← Legal & Compliance Library Sub-processor list · current

Sub-processor list

Every third party that processes personal data on behalf of Vault Hire in connection with the Service. Updated every time we add, remove, or change a sub-processor; customers under DPA are notified by email and in-app on any material change with a 14-day window to object.

Document ID
VH-SUBP-001
Current version
1.0 · 14 February 2026
Subscribe to changes
Customers under DPA are auto-subscribed. Prospects may subscribe at trust@vault-hire.com
Notice period
14 days before any new sub-processor is engaged (UK GDPR Art. 28(2))

This list is the live source. Any older snapshot (e.g. attached to your DPA) is superseded by this page.

Print / Save snapshot

1 Infrastructure & data hosting

Sub-processorPurposeLocationTransfer mechanism
MongoDB Atlas
MongoDB Inc.		 Primary database — encrypted storage of vault records, audit logs, governance settings. EU regions (Ireland) UK adequacy + EU SCCs incorporated into MongoDB DPA
Cloud hosting provider
Provider identity available under NDA — common enterprise-tier provider with SOC 2, ISO 27001, ISO 27018		 Application compute, networking, secret storage. EU regions UK adequacy + EU SCCs

2 AI & ML

Sub-processorPurposeLocationTransfer mechanism
Anthropic, PBC (via Emergent integrations gateway) Large-language-model inference for the five identified AI workflows (see IfU §2). No-training contractual terms. Prompt and response are not retained by the provider beyond the API call. EU-routed endpoints where available; otherwise US. EU SCCs Module 2 + UK Addendum, executed with Anthropic. Transfer Impact Assessment on file.
Emergent Labs (LLM gateway) API gateway routing layer between Vault Hire and Anthropic. Does not retain prompt / response bodies. EU + US EU SCCs Module 3 (processor-to-processor) + UK Addendum

3 Payments & billing

Sub-processorPurposeLocationTransfer mechanism
Stripe Payments Europe Ltd Card-not-present payment processing for subscription tiers and PAYG packs. PCI-DSS Level 1 certified. Vault Hire does not store cardholder data. Ireland (EU) UK adequacy (Ireland is EEA); Stripe US transfers under SCCs

4 Identity verification & compliance hooks

Sub-processorPurposeLocationTransfer mechanism
Companies House (UK Govt.) Employer-account verification — registered company lookup. No personal data sent; company number only. UK Domestic (UK)
OpenSanctions Optional sanctions / PEP screening for KYC workflows where the customer enables it. EU UK adequacy

5 Transactional email (planned)

Sub-processorPurposeLocationTransfer mechanism
Email delivery provider (selection in progress — SendGrid or Resend, target Q1 2026) Transactional email delivery (password reset, magic link, reference requests, walkthrough access). Will be added to this list and notified to customers under DPA 14 days before activation. EU regions preferred SCCs + DPA

6 What we do NOT use

For clarity, the following common SaaS sub-processors are not currently in scope for personal-data processing:

  • Google Workspace (no candidate or employee data is stored in Google Workspace).
  • Microsoft 365 (same).
  • Salesforce / HubSpot / any CRM that would receive candidate PII.
  • Any analytics provider that fingerprints visitors (no Google Analytics, no Hotjar, no Mixpanel).
  • Any AI provider not listed in §2 above. Vault Hire does not multiplex between AI vendors.

Object to a sub-processor

If you are a Vault Hire customer under DPA and you wish to object to any sub-processor listed above, write to trust@vault-hire.com within 14 days of the change notification. We will assess whether an alternative configuration is possible. If not, you may terminate the affected Service per DPA §5 on a pro-rata refund basis.