Compliance

Subprocessors

Third-party services Evalgist BV relies on to operate evalgist.ai and the live Evalgist Shortlist product, covering hosting, authentication, document storage, AI processing, payments, and analytics. AI processing is routed through OpenRouter with zero data retention enabled; the publishers whose models are used in production, currently Anthropic (analysis) and Mistral (OCR), are listed below. OpenRouter selects the zero-data-retention endpoint that serves the requested model, which may be operated by the model publisher or by a hosting partner. AI providers do not retain customer documents or use them for training. Material changes are communicated to active customers at least 30 days in advance.

Vercel

active

Vercel Inc.

Purpose: Application hosting, edge delivery, and build infrastructure.
Location: United States (HQ), with edge presence in Europe.
Data residency: Application code and cached responses on EU edge nodes when reached from EU.
Privacy: vercel.com/legal/privacy-policy

Cloudflare

active

Cloudflare, Inc.

Purpose: Authoritative DNS and domain-name management for evalgist.ai.
Location: United States (HQ), with a global anycast DNS network.
Data residency: DNS query data may be processed on Cloudflare's global anycast network, including outside the EU, under Cloudflare's DPA and transfer safeguards. Application traffic is served directly by Vercel and does not pass through Cloudflare.
Privacy: www.cloudflare.com/privacypolicy

Clerk

active

Clerk, Inc.

Purpose: Authentication, identity, sessions, and shared Evalgist account management.
Location: United States.
Data residency: Account and authentication data stored in the United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed).
Privacy: clerk.com/legal/privacy

Supabase

active

Supabase Inc.

Purpose: Product database, file storage, and auth-adjacent RLS data layer.
Location: Singapore (HQ); EU project hosted in Ireland (eu-west-1).
Data residency: Customer data is stored in EU product projects (Ireland, eu-west-1).
Privacy: supabase.com/privacy

OpenRouter

active

OpenRouter, LLC

Purpose: AI model routing for product document analysis with zero data retention enabled.
Location: United States.
Data residency: Customer document prompts are routed with zero data retention.
Privacy: openrouter.ai/privacy

Anthropic

active

Anthropic, PBC (model publisher)

Purpose: Publisher of the Claude models used for document analysis. Prompts reach these models only through OpenRouter zero-data-retention endpoints, operated by the publisher or a hosting partner OpenRouter selects for the requested model.
Location: United States (publisher HQ).
Data residency: Prompts are processed transiently on the selected zero-data-retention endpoint; processing location follows that endpoint and is not EU-only. Customer documents are not retained or used for training on these endpoints.
Privacy: www.anthropic.com/legal/privacy

Mistral

active

Mistral AI (model publisher)

Purpose: Publisher of the OCR models used for scanned documents. Prompts reach these models only through OpenRouter zero-data-retention endpoints, operated by the publisher or a hosting partner OpenRouter selects for the requested model.
Location: France (publisher HQ).
Data residency: Prompts are processed transiently on the selected zero-data-retention endpoint; processing location follows that endpoint and is not EU-only. Customer documents are not retained or used for training on these endpoints.
Privacy: legal.mistral.ai/terms/privacy-policy

Resend

active

Resend (Plus Five Five, Inc.)

Purpose: Transactional email delivery and waitlist contact storage.
Location: United States (San Francisco, CA); email dispatch from EU region (eu-west-1, Ireland).
Data residency: Sending: EU. Account data, metadata, logs, and Audiences contact storage: United States, under EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed).
Privacy: resend.com/legal/privacy-policy

Proton

active

Proton AG

Purpose: Email hosting for Evalgist company mailboxes used for product, billing, legal, security, and privacy correspondence.
Location: Switzerland.
Data residency: Customer correspondence and related mail metadata are processed in Switzerland, which has an EU adequacy decision.
Privacy: proton.me/legal/privacy

Stripe

active

Stripe Payments Europe Limited

Purpose: Payment processing for credit purchases.
Location: Ireland (EU).
Data residency: EU.
Privacy: stripe.com/privacy

Silvasoft

active

Silvasoft B.V.

Purpose: Accounting and invoice generation for credit purchases. Receives invoice data when a Stripe checkout completes; no resume or exam content.
Location: Netherlands (EU).
Data residency: EU.
Privacy: www.silvasoft.nl/privacy

PostHog

active

PostHog Inc., EU cloud

Purpose: Cookieless, non-persistent analytics for site pageviews, waitlist funnel measurement, and Shortlist product-workflow events carrying typed metadata and pseudonymous account identifiers (account ID, hashed email). No session recording, no payment data, no resume or exam content.
Location: United States (HQ); EU cloud at eu.posthog.com.
Data residency: EU.
Privacy: posthog.com/privacy

Sentry

active

Functional Software Inc., operating as Sentry

Purpose: Error monitoring and performance tracing across platform apps. Captures stack traces and request metadata; PII routes are excluded and Session Replay is disabled platform-wide.
Location: United States (HQ); EU region used (ingest.de.sentry.io).
Data residency: EU.
Privacy: sentry.io/privacy

Questions? Email legal@evalgist.ai.

Last updated 2026-07-22