Sub-processors
Last updated: October 2026
This page lists the sub-processors that Marxel uses to process personal data on behalf of our customers. This list forms Annex 1 of our Data Processing Agreement.
We will provide at least 14 days' notice before engaging any new sub-processor. If you have questions or wish to object to a sub-processor, contact us at hello@marxel.co.
Authorised Sub-processors
The following sub-processors are authorised to process personal data on behalf of our customers:
| Sub-processor | Purpose | Location | Data Processed | Evidence |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and delivery | United States / global infrastructure | Application traffic, logs, and customer data in transit | Vercel DPA |
| Railway Corporation | Application database hosting | European Union (application database); United States (provider) | Application database records and customer data at rest | Railway DPA |
| UploadThing | Legacy CV file storage and file uploads where configured | United States / global infrastructure | Uploaded files, filenames, file URLs, and file metadata | UploadThing Privacy Policy |
| Google LLC (Google Cloud) | Private CV file storage and background CV processing | Selected Google Cloud infrastructure regions | Uploaded CV files, filenames, extracted text, and candidate data processed by background workers | Google Cloud Data Processing Addendum |
| Inngest Inc. | Workflow orchestration for CV processing and background jobs | United States | Workflow event payloads and step results, including candidate identifiers, file references, recruitment data, and processing metadata | Inngest Security and DPA information |
| OpenAI, L.L.C. | Text embeddings for candidate search and retrieval | United States | Candidate names, CV text, evaluation summaries, and search queries submitted for embeddings | OpenAI DPA |
| Anthropic, PBC | Primary AI provider for CV parsing, OCR, screening, assistants, and other AI features | United States | Candidate data submitted to AI features | Anthropic DPA |
| Google LLC (Gemini API) | Enabled backup AI provider for supported tasks when the primary provider is unavailable or declines a request | United States / global infrastructure | Candidate data submitted to AI features during fallback | Gemini API Additional Terms (paid services) |
| Sentry | Error monitoring and performance monitoring | United States / European Union | Error events, diagnostics, and operational metadata | Sentry DPA |
| Resend Inc. | Transactional email delivery | United States | Email addresses, names, and email content | Resend Privacy |
| Stripe Inc. | Payment processing and subscription management | United States / global infrastructure | Billing data and subscription metadata, not CV content | Stripe DPA |
| PostHog Inc. | Authenticated-application analytics and session replay linked to account email | United States / European Union | Account email, usage events, product analytics metadata, and session replay recordings of visible product and user-entered text in the authenticated application | PostHog DPA |
| Google LLC | Google OAuth authentication, public-page and app analytics, Google Ads conversion measurement, and optional sending from a connected Gmail account | United States / global infrastructure | OAuth profile data, email addresses, IP addresses, analytics events, and (for connected Gmail accounts) the content of messages Marxel sends. Marxel does not read Gmail mailboxes | Google API Services User Data Policy |
| Microsoft Corporation | Microsoft Entra ID OAuth sign-in and optional Outlook mailbox reading and sending through Microsoft Graph | United States / global infrastructure | OAuth profile data, email addresses, IP addresses, and (for connected Outlook mailboxes) participant addresses, message metadata, plain-text bodies, attachment metadata, and sent-message content. Marxel stores provider links where supplied, not attachment bytes | Microsoft Privacy |
| Upstash, Inc. | Redis-backed caching and rate limiting when configured | United States / selected infrastructure region | Cache keys, cached AI outputs, and rate-limit metadata | Upstash DPA |
| Crisp IM SAS | Website live chat support when configured | European Union | Chat messages, email addresses provided in chat, IP addresses, and browser metadata | Crisp Privacy Policy |
Transfer Safeguards
We rely on provider data processing terms, transfer mechanisms such as Standard Contractual Clauses where applicable, and supplementary safeguards appropriate to each service.
For transfers from the UK, we also rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs where applicable.
Notification of Changes
We will update this page and provide at least 14 days' notice before engaging any new sub-processor.
If you wish to be notified of changes by email, please contact us at hello@marxel.co to subscribe to sub-processor updates.
Objection Process
If you have reasonable data protection grounds to object to a new sub-processor:
- Notify us within 14 days of receiving notice of the change
- Explain your objection with reference to specific data protection concerns
- We will work with you to find a mutually acceptable solution
- If no resolution is reached, you may terminate the affected service with no penalty
Contact
For questions about our sub-processors or to request a copy of the safeguards in place:
Email: hello@marxel.co
See also our Data Processing Agreement, Privacy Notice, and Terms of Service or contact us with any questions.