EU core infrastructure with transparent data transfers.
CVs, profiles, and AI processing remain in the EU. We use Resend for inbound and outbound email with routing through Ireland; US processing is safeguarded by a DPA, the Data Privacy Framework, and Standard Contractual Clauses.
Last updated: August 2026
EU core systems and clearly disclosed transfers
Storage location, processing path, and transfer basis for every relevant service.
Candidate data in Frankfurt
CVs, extracted profiles, and matching results are stored on AWS servers in Frankfurt. Database and file storage operated via Supabase in region eu-central-1.
AI inference in Paris & Belgium
Default provider is Mistral AI — Europe’s leading AI champion, fully hosted in France. Optional Vertex AI in region europe-west4 (Belgium). Both on EU infrastructure, with no US detour.
Web application in Frankfurt
The HireSift platform runs on Vercel Serverless Functions in region fra1 (Frankfurt). Application-owned API routes and database queries execute there; external sub-processors are disclosed separately.
Transparent email provider
Inbound and outbound email runs through Resend. Routing uses Ireland; account, metadata, log, and API processing may take place in the United States.
No model training on your data
Neither Mistral AI nor Vertex AI retains transmitted data or uses it for model training — contractually guaranteed in each provider’s service terms.
GDPR and transfer safeguards
HireSift is operated by an Austrian company under the GDPR. International transfers through Resend are documented through a DPA, the EU-US Data Privacy Framework, and Standard Contractual Clauses.
Where your data is actually processed
Transparency is not optional — it is the core of our offering. Here is every physical location.
EU — Candidate data
EU — Mail routing and payments
USA — Email service
Sub-processors in detail
The complete list of services we use to operate HireSift. Every provider is bound by Data Processing Agreements under Art. 28 GDPR.
| Provider | Purpose | Location | Transfer Basis |
|---|---|---|---|
Supabase | Database & file storage (including CVs) | EU — Frankfurt (AWS eu-central-1) | GDPR-compliant, no third-country transfer |
Vercel | Web application hosting & serverless functions | EU — Frankfurt (fra1) | GDPR-compliant, no third-country transfer |
Mistral AI | Default AI for CV extraction (Document AI / OCR + annotations) | EU — Paris, France | GDPR-compliant, no third-country transfer, no model training on customer data |
Vertex AI | Alternative AI models (Gemini, Claude) for scoring & re-extraction | EU — Belgium (europe-west4) | GDPR-compliant, no third-country transfer |
Resend | Inbound parsing and outbound sending of application and transactional emails | Routing: Ireland (eu-west-1); account, metadata, log, and API processing: USA | DPA + EU-US Data Privacy Framework + Standard Contractual Clauses |
Mixpanel | Product analytics for service improvement | EU — Frankfurt (eu.mixpanel.com) | GDPR-compliant, no third-country transfer |
Stripe | Payment processing & subscription management | EU — Ireland (Stripe Technology Company Ltd.) | DPA with EU contracting party; internal cross-border flows under SCCs |
CVs, extracted profiles, and match scores are stored in the EU. Application emails and attachments are processed through Resend; the necessary international transfers are contractually and technically documented.
Answers to enterprise audit questions
The most common questions from vendor audits, security reviews, and privacy assessments.
Documents & Resources
Everything in one place: legal documents for direct review and download, plus links to the public policies. Enterprise buyers additionally receive the security questionnaire and custom DPA variants on request.
Legal documents (GDPR & EU AI Act)
Subprocessor list
All deployed providers with processing location and legal basis. Annex 2 to the DPA.
Technical and Organizational Measures (TOMs)
Security measures under GDPR Art. 32: encryption, access controls, backup, incident response. Annex 1 to the DPA.
Data Protection Impact Assessment (DPIA)
Risk analysis for AI-driven CV screening under GDPR Art. 35 and the EU AI Act (high-risk system under Annex III 4a).
Data Processing Agreement (DPA) — Template
Standard DPA under GDPR Art. 28 for review. Individual signing on request: hello@hiresift.ai
More pages
Evaluating whether HireSift would pass your vendor audit?
DPA, TOMs, DPIA, subprocessor list and data-subject-rights process are available above for direct download. For individual questions, enterprise tailoring, or security questionnaires, just get in touch.