Compliance

Subprocessors

Third-party services Evalgist BV relies on today, plus planned processors that will be used before product apps handle customer documents. Current evalgist.ai processing is limited to hosting, analytics, and waitlist email storage. AI providers do not retain customer documents. Material changes are communicated to active customers at least 30 days in advance.

Active

Vercel

active

Vercel Inc.

Purpose: Application hosting, edge delivery, and build infrastructure.
Location: United States (HQ), with edge presence in Europe.
Data residency: Application code and cached responses on EU edge nodes when reached from EU.
Privacy: vercel.com/legal/privacy-policy

Clerk

active

Clerk, Inc.

Purpose: Authentication, identity, sessions, and shared Evalgist account management.
Location: United States.
Data residency: Account and authentication data handled under Clerk's data protection terms.
Privacy: clerk.com/legal/privacy

Resend

active

Resend (Plus Five Five, Inc.)

Purpose: Transactional email delivery and waitlist contact storage.
Location: United States (San Francisco, CA); email dispatch from EU region (eu-west-1, Ireland).
Data residency: Sending: EU. Account data, metadata, logs, and Audiences contact storage: United States, under EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed).
Privacy: resend.com/legal/privacy-policy

PostHog

active

PostHog Inc., EU cloud

Purpose: Cookieless, non-persistent product analytics for manual pageviews and waitlist funnel measurement. Captures email domain on signup, not raw email. No payment data, no resume or exam content.
Location: United States (HQ); EU cloud at eu.posthog.com.
Data residency: EU.
Privacy: posthog.com/privacy

Sentry

active

Functional Software Inc., operating as Sentry

Purpose: Error monitoring and performance tracing across platform apps. Captures stack traces and request metadata; PII routes are excluded and Session Replay is disabled platform-wide.
Location: United States (HQ); EU region used (ingest.de.sentry.io).
Data residency: EU.
Privacy: sentry.io/privacy

Planned

Supabase

planned

Supabase Inc.

Purpose: Planned product database, file storage, and auth-adjacent RLS data layer.
Location: Singapore (HQ); EU project hosted in Ireland (eu-west-1).
Data residency: Customer data will be stored in EU product projects.
Privacy: supabase.com/privacy

OpenRouter

planned

OpenRouter, LLC

Purpose: AI model routing for product document analysis with zero data retention enabled.
Location: United States.
Data residency: Customer document prompts are routed with zero data retention where product AI processing is used.
Privacy: openrouter.ai/privacy

Stripe

planned

Stripe Payments Europe Limited

Purpose: Payment processing for credit purchases.
Location: Ireland (EU).
Data residency: EU.
Privacy: stripe.com/privacy

Questions about how data flows through these services? Email legal@evalgist.ai.

Last updated 2026-05-14