SkillCort Legal
Subprocessors
The third parties SkillCort uses to provide the Service, what each one processes, and where. Effective August 9, 2026.
SkillCort LLC uses the following subprocessors to provide the assessment platform. Several are engaged only when the customer enables the corresponding feature — those rows say so. Candidate assessment data is hosted in the EU (Frankfurt); columns note where a provider processes anything beyond that.
Current subprocessors
| Subprocessor | Service | Candidate data involved | Location |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd) | Database, file storage, authentication | Yes — all categories | Data hosted in Frankfurt, Germany (EU) |
| Vercel Inc | Application hosting | In transit | Frankfurt (EU, fra1); US entity, DPF-certified |
| Resend (Plus Five Five, Inc) | Transactional email (invitations, reminders) | Name, email, access link | US, DPF-certified |
| OpenAI, LLC | Speech-to-text and text-to-speech; AI-assisted review of proctoring media (reviewer-triggered); live AI-interviewer speech | Voice audio and proctoring-media frames | US, DPF-certified; no training on API content; abuse-monitoring retention ≤ 30 days |
| Anthropic | Default AI model (evaluation summaries, suggestions, drafting) | Name, answers, transcripts, answer media | US; contractually barred from training on this content |
| HeyGen Technology Inc (incl. LiveAvatar) | Interviewer avatar rendering and streaming | None — receives authored question text only and streams the avatar to the candidate | US, DPF-certified |
| Cloudflare, Inc | Live webcam view relay — only during a staff live view; never recorded | Live camera feed (transient) | Global network; US entity, DPF-certified |
How this list is maintained
- Customers with a signed Data Processing Addendum are notified of intended additions or replacements at least 30 days in advance and may object on reasonable data-protection grounds (DPA §6).
- Each material subprocessor is reviewed at least once every twelve months, and after any material change or confirmed security incident.
- Retired providers are removed from this page when the last processing ends. Most recently retired: D-ID (avatar rendering), replaced by HeyGen in August 2026.
Questions about a specific provider, transfer mechanism, or our review records: privacy@skillcort.com.