Evalgist
Evalgist Shortlist
Subprocessors
Third-party services Evalgist BV relies on to operate evalgist.ai and the live Evalgist Shortlist product, covering hosting, authentication, document storage, AI processing, payments, and analytics. AI processing is routed through OpenRouter with zero data retention enabled; the publishers whose models are used in production, currently Anthropic (analysis) and Mistral (OCR), are listed below. OpenRouter selects the zero-data-retention endpoint that serves the requested model, which may be operated by the model publisher or by a hosting partner. AI providers do not retain customer documents or use them for training. Material changes are communicated to active customers at least 30 days in advance.
| Subprocessor | Legal entity | Purpose | Location | Data residency | Status | Privacy |
|---|---|---|---|---|---|---|
| Vercel | Vercel Inc. | Application hosting, edge delivery, and build infrastructure. | United States (HQ), with edge presence in Europe. | Application code and cached responses on EU edge nodes when reached from EU. | active | https://vercel.com/legal/privacy-policy |
| Cloudflare | Cloudflare, Inc. | Authoritative DNS and domain-name management for evalgist.ai. | United States (HQ), with a global anycast DNS network. | DNS query data may be processed on Cloudflare's global anycast network, including outside the EU, under Cloudflare's DPA and transfer safeguards. Application traffic is served directly by Vercel and does not pass through Cloudflare. | active | https://www.cloudflare.com/privacypolicy/ |
| Clerk | Clerk, Inc. | Authentication, identity, sessions, and shared Evalgist account management. | United States. | Account and authentication data stored in the United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed). | active | https://clerk.com/legal/privacy |
| Supabase | Supabase Inc. | Product database, file storage, and auth-adjacent RLS data layer. | Singapore (HQ); EU project hosted in Ireland (eu-west-1). | Customer data is stored in EU product projects (Ireland, eu-west-1). | active | https://supabase.com/privacy |
| OpenRouter | OpenRouter, LLC | AI model routing for product document analysis with zero data retention enabled. | United States. | Customer document prompts are routed with zero data retention. | active | https://openrouter.ai/privacy |
| Anthropic | Anthropic, PBC (model publisher) | Publisher of the Claude models used for document analysis. Prompts reach these models only through OpenRouter zero-data-retention endpoints, operated by the publisher or a hosting partner OpenRouter selects for the requested model. | United States (publisher HQ). | Prompts are processed transiently on the selected zero-data-retention endpoint; processing location follows that endpoint and is not EU-only. Customer documents are not retained or used for training on these endpoints. | active | https://www.anthropic.com/legal/privacy |
| Mistral | Mistral AI (model publisher) | Publisher of the OCR models used for scanned documents. Prompts reach these models only through OpenRouter zero-data-retention endpoints, operated by the publisher or a hosting partner OpenRouter selects for the requested model. | France (publisher HQ). | Prompts are processed transiently on the selected zero-data-retention endpoint; processing location follows that endpoint and is not EU-only. Customer documents are not retained or used for training on these endpoints. | active | https://legal.mistral.ai/terms/privacy-policy |
| Resend | Resend (Plus Five Five, Inc.) | Transactional email delivery and waitlist contact storage. | United States (San Francisco, CA); email dispatch from EU region (eu-west-1, Ireland). | Sending: EU. Account data, metadata, logs, and Audiences contact storage: United States, under EU-U.S. Data Privacy Framework and Standard Contractual Clauses (DPA signed). | active | https://resend.com/legal/privacy-policy |
| Proton | Proton AG | Email hosting for Evalgist company mailboxes used for product, billing, legal, security, and privacy correspondence. | Switzerland. | Customer correspondence and related mail metadata are processed in Switzerland, which has an EU adequacy decision. | active | https://proton.me/legal/privacy |
| Stripe | Stripe Payments Europe Limited | Payment processing for credit purchases. | Ireland (EU). | EU. | active | https://stripe.com/privacy |
| Silvasoft | Silvasoft B.V. | Accounting and invoice generation for credit purchases. Receives invoice data when a Stripe checkout completes; no resume or exam content. | Netherlands (EU). | EU. | active | https://www.silvasoft.nl/privacy |
| PostHog | PostHog Inc., EU cloud | Cookieless, non-persistent analytics for site pageviews, waitlist funnel measurement, and Shortlist product-workflow events carrying typed metadata and pseudonymous account identifiers (account ID, hashed email). No session recording, no payment data, no resume or exam content. | United States (HQ); EU cloud at eu.posthog.com. | EU. | active | https://posthog.com/privacy |
| Sentry | Functional Software Inc., operating as Sentry | Error monitoring and performance tracing across platform apps. Captures stack traces and request metadata; PII routes are excluded and Session Replay is disabled platform-wide. | United States (HQ); EU region used (ingest.de.sentry.io). | EU. | active | https://sentry.io/privacy/ |
Last updated July 22, 2026.