Subprocessors
Last updated: July 9, 2026
VacantSeek uses the third-party services below ("subprocessors") to operate the platform. Each one is bound by a Data Processing Agreement that requires it to handle your data only as our service provider, in line with GDPR Article 28 and the California Consumer Privacy Act.
We notify customers in advance of material changes to this list. To request a copy of our DPA for signature, email support through the contact link in the footer.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting (ECS Fargate, Application Load Balancer, Secrets Manager, CloudWatch Logs) and static frontend hosting/CDN (S3, CloudFront). | All application data in transit; logs may contain user IDs and email addresses. | United States (us-east-1) |
| Amazon RDS for PostgreSQL | Managed Postgres database. Note: user authentication is self-hosted — VacantSeek's own backend issues and verifies login credentials and session tokens directly against this database; no third-party identity provider is used. | Account profiles, listings, leads, messages, OAuth tokens (encrypted at rest); hashed login credentials, hashed refresh tokens, and email-verification state. | United States (us-east-1) |
| Google (Gmail / OAuth) | Email sending and inbound lead capture via Gmail API. | Email content, sender/recipient addresses, OAuth credentials (Limited Use scope). | United States |
| Resend | Transactional email delivery (signup confirmations, password resets, notifications). | Email addresses, message bodies, delivery metadata. | United States |
| Stripe | Payment processing and subscription billing. | Name, billing address, last-4 of card. Full card data is handled by Stripe and never seen by us. | United States / Ireland |
| OpenAI | AI-assisted reply drafting and summarization features. | Lead messages and email content the user submits for processing. Not used for model training (zero-retention API). | United States |
| PostHog | Product analytics — session replay, feature flags, event tracking. | Pseudonymous user ID, page views, click events, device info. Blocked by default until consent is granted. | United States |
| BigDataCloud | Reverse geocoding for location-based personalization. | Approximate latitude/longitude (no precise GPS, no identifiers). | Australia / global CDN |
| Google Analytics 4 / Tag Manager | Aggregate website usage analytics — only when consent is granted. | Pseudonymous client ID, page views, basic device info. Blocked by default via Consent Mode v2. | United States |
International transfers
Most subprocessors are located in the United States. Where personal data of EU/UK residents is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses included in each vendor's DPA, plus supplementary measures (encryption in transit and at rest, Limited Use commitments for Google API data).
Contact
Questions about this list, or to request a signed DPA, see the contact details on our Privacy Policy page.