Data as of Sep 21, 2026, 11:47 AM UTC
Subprocessors
Third-party vendors that process or have access to data as part of the HRMLESS platform. This list is sourced live from our compliance platform.
12 vendors monitored
Vendor Inventory
| Vendor | Description | Category |
|---|---|---|
| Microsoft Azure is a comprehensive cloud computing platform offering a wide range of services including computing, analytics, storage, and networking. | Cloud Provider | |
| Brickwork India provides virtual assistant services to help businesses with administrative tasks, research, and other support functions. | Office Operations | |
| Twilio is a cloud communications platform that provides APIs for developers to add messaging, voice, video, and email capabilities to applications. | Collaboration | |
| AI analysis and assessment generation (Claude). Interview transcripts and candidate data submitted for analysis. Third-party service provider (not a subservice organization under the carve-out method). | Data Storage And Processing | |
| AI analysis and assessment generation (GPT-4). Interview transcripts and candidate data submitted for analysis. Third-party service provider (not a subservice organization under the carve-out method). | Data Storage And Processing | |
| Conversational AI voice synthesis for interview sessions. Interview audio/conversation data during active sessions only; no persistent storage. Third-party service provider (not a subservice organization under the carve-out method). | Data Storage And Processing | |
| ATS integration middleware. Customer ATS data retained for differential sync updates, scoped by customer-granted permissions. Third-party service provider (not a subservice organization under the carve-out method). | Data Storage And Processing | |
| Payment and subscription processing. Customer payment information and subscription data retained by Stripe under PCI DSS compliance. Third-party service provider (not a subservice organization under the carve-out method). | Finance | |
| DNS, TLS termination, WAF, geo-based load balancing, and WebRTC SFU for video interviews. Customer traffic passes through Cloudflare edge; no persistent data storage. Third-party service provider (not a subservice organization under the carve-out method). | Security | |
| M365 (Outlook, SharePoint, Teams, Planner) and Entra ID for identity and access management. Central identity provider for all internal access. Internal business data and employee identity data. Third-party service provider (not a subservice organization under the carve-out method). | Identity Provider | |
| CloudStack infrastructure compute and storage for RKE2 Kubernetes cluster (West + Central availability zones). Application workloads process customer data in transit and in memory. Subservice organization under the carve-out method -- physical security controls delegated to EGN colocation provider. | Cloud Provider | |
| Managed PostgreSQL database, S3-compatible object storage (Spaces), database backups, Docker container registry. Customer data stored in database and object storage. Subservice organization under the carve-out method -- physical security controls delegated to colocation data centers. | Cloud Provider |
For detailed vendor compliance evidence including SOC 2 report status, sign in to view the full vendor assessment.