EU core infrastructure with transparent data transfers.
No US cloud regions are used to store or process applicant data: CVs, profiles, and AI analyses remain in EU data centers. We still use the best and latest AI models.
Last updated: August 2026
EU core systems and clearly disclosed transfers
Storage location, processing path, and transfer basis for every relevant service.
Candidate data in Frankfurt
CVs, extracted profiles, and matching results are stored on AWS servers in Frankfurt. Database and file storage operated via Supabase in region eu-central-1.
AI inference in Paris & Belgium
Default provider is Mistral AI — Europe’s leading AI champion, fully hosted in France. Optional Vertex AI in region europe-west4 (Belgium). Both AI paths run on EU infrastructure.
Web application in Frankfurt
The HireSift platform runs on Vercel Serverless Functions in region fra1 (Frankfurt). Application-owned API routes and database queries execute there; external sub-processors are disclosed separately.
Transparent email provider
Inbound and outbound email runs through Resend. Routing uses Ireland; supplementary provider processing may take place outside the EEA and is contractually safeguarded.
No model training on your data
Neither Mistral AI nor Vertex AI retains transmitted data or uses it for model training — contractually guaranteed in each provider’s service terms.
GDPR and transfer safeguards
HireSift is operated by an Austrian company under the GDPR. International transfers through Resend are documented through a DPA, a valid adequacy decision, and Standard Contractual Clauses.
Our EU data locations
These are the EU locations for core storage, AI processing, web hosting, and email routing. Supplementary provider processing is disclosed in the sub-processor list.
EU — Candidate data
EU — Mail routing and payments
Sub-processors in detail
The complete list of services we use to operate HireSift. Every provider is bound by Data Processing Agreements under Art. 28 GDPR.
| Provider | Purpose | Location | Transfer Basis |
|---|---|---|---|
Supabase | Database & file storage (including CVs) | EU — Frankfurt (AWS eu-central-1) | GDPR-compliant, no third-country transfer |
Vercel | Web application hosting & serverless functions | EU — Frankfurt (fra1) | GDPR-compliant, no third-country transfer |
Mistral AI | Default AI for CV extraction (Document AI / OCR + annotations) | EU — Paris, France | GDPR-compliant, no third-country transfer, no model training on customer data |
Vertex AI | Alternative AI models (Gemini, Claude) for scoring & re-extraction | EU — Belgium (europe-west4) | GDPR-compliant, no third-country transfer |
Resend | Inbound parsing and outbound sending of application and transactional emails | Email routing: EU — Ireland (eu-west-1); supplementary provider processing under the DPA | DPA + valid adequacy decision + Standard Contractual Clauses |
Mixpanel | Product analytics for service improvement | EU — Frankfurt (eu.mixpanel.com) | GDPR-compliant, no third-country transfer |
Stripe | Payment processing & subscription management | EU — Ireland (Stripe Technology Company Ltd.) | DPA with EU contracting party; internal cross-border flows under SCCs |
CVs, extracted profiles, and match scores are stored in the EU. Application emails and attachments are processed through Resend; the necessary international transfers are contractually and technically documented.
Answers to enterprise audit questions
The most common questions from vendor audits, security reviews, and privacy assessments.
Documents & Resources
Everything in one place: legal documents for direct review and download, plus links to the public policies. Enterprise buyers additionally receive the security questionnaire and custom DPA variants on request.
Legal documents (GDPR & EU AI Act)
Subprocessor list
All deployed providers with processing location and legal basis. Annex 2 to the DPA.
Technical and Organizational Measures (TOMs)
Security measures under GDPR Art. 32: encryption, access controls, backup, incident response. Annex 1 to the DPA.
Data Protection Impact Assessment (DPIA)
Risk analysis for AI-driven CV screening under GDPR Art. 35 and the EU AI Act (high-risk system under Annex III 4a).
Data Processing Agreement (DPA) — Template
Standard DPA under GDPR Art. 28 for review. Individual signing on request: hello@hiresift.ai
More pages
Evaluating whether HireSift would pass your vendor audit?
DPA, TOMs, DPIA, subprocessor list and data-subject-rights process are available above for direct download. For individual questions, enterprise tailoring, or security questionnaires, just get in touch.