Sub-Processors & Third-Party Embeds Directory
Our Enterprise AI Zero-Retention Guarantee
SOLLERT contracts with enterprise AI model providers under strict Zero Data Retention (ZDR) agreements and Business Associate terms. Candidate answers, code submissions, and recruiter evaluations are processed ephemerally in volatile memory. They are never stored by AI providers, never logged to third-party disk, and never utilized to train foundation models.
Active Production Sub-Processors
Pursuant to Article 28 of the GDPR, the following third-party service providers assist SOLLERT in delivering technical screening capabilities:
| Sub-Processor | Operational Role | Data Categories | Location & Safeguards |
|---|---|---|---|
| PostgreSQL / Managed Database Services | Core application database, tenant-isolated candidate records, encrypted scorecards, and audit logs. | Candidate details, resumes, interview transcripts, scores, recruiter accounts | United States / European Union (Configurable) SOC 2 Type II, ISO 27001, AES-256 Encryption at Rest |
| Redis Cluster In-Memory Cache | Ephemeral session cache, live rate-limiting, and interview turn state queues. | Transient session tokens, rate-limit counters (ephemeral only) | United States / European Union SOC 2, TLS 1.3 in Transit, Volatile TTL Purging |
| Enterprise AI Inference APIs (OpenAI / Anthropic / DeepSeek) | Real-time conversational turn generation, adaptive question calibration, and 100-point rubric synthesis. | Sanitized question prompts, candidate verbal answer text (Zero Data Retention agreement) | United States Enterprise Zero Data Retention (ZDR) Agreement · Never used for model training |
| Stripe Inc. | Secure billing checkout, recurring subscription invoicing, and payment processing. | Customer name, billing address, credit card token (raw cards never touch Sollert) | United States / Global PCI-DSS Level 1 Service Provider, SOC 1 / SOC 2 |
| Resend / Transactional Email Service | Sending candidate interview invitations, score notification digests, and password reset links. | Recipient email address, candidate name, interview invitation URLs | United States SOC 2 Type II, GDPR Data Processing Addendum, TLS delivery |
| Sentry Telemetry & Crash Reporting | Real-time application crash detection and speech API latency monitoring. | Aggregated error stack traces, browser user-agent, error line numbers (PII scrubbed) | United States SOC 2 Type II, Automatic Client-Side PII Redaction Filters |
Third-Party Scripts & Embeds Policy
Unlike consumer websites, SOLLERT enforces a strict Zero Invasive Embeds architecture:
- No Social Media Trackers: We do not embed Facebook/Meta Pixels, LinkedIn Insight Tags, TikTok pixels, or advertising beacons on candidate assessment portals.
- Sandboxed Code Execution: Candidate coding environments execute in isolated containerized sandboxes with restricted network egress, ensuring candidate code cannot be exfiltrated or corrupted by third-party scripts.
- Sub-Processor Vetting: Before engaging any new sub-processor, SOLLERT conducts rigorous security reviews, verifies SOC 2 compliance, and executes a formal Data Processing Addendum (DPA) containing Standard Contractual Clauses.
Sub-Processor Change Notification Protocol
SOLLERT provides workspace administrators with at least thirty (30) days advance notice via email prior to onboarding any new sub-processor that handles customer personal data. Customers may object to the appointment of a new sub-processor on reasonable data protection grounds by contacting privacy@sollert.io.