Current subprocessors
These are the third parties that process personal data on Itya's behalf so the service can run. 6 are engaged for every deployment. 10 are marked conditional: they process nothing unless a workspace connects them or a deployment enables the feature that uses them.
| Subprocessor | Purpose | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Oracle Cloud InfrastructureOracle Corporation | Hosting, compute, and managed block storage for the database. In the reference deployment the S3-compatible object store that holds recordings, transcripts, resumes and exports also runs on this infrastructure; a deployment that points the object-store endpoint at Amazon S3 sends those objects to AWS instead (see the AWS entry below). | All workspace, candidate and interview data at rest, including recordings, transcripts, resumes and audit records. | The OCI region configured for the deployment (EU or US). | EU SCCs (Module Three) plus the UK Addendum where the region sits outside the EEA or UK. |
| AnthropicAnthropic PBC | Large-language-model generation for AI scorecards, interview debriefs and job/rubric drafting. This is the default scoring and debrief provider. | Interview transcript excerpts, job descriptions and rubrics, and any personal data those texts contain. | United States | EU SCCs (Module Three) plus the UK Addendum. |
| OpenAIOpenAI, L.L.C. | Speech-to-text transcription of interview audio (Whisper). Also serves scorecards and debriefs where a deployment sets the scoring or debrief provider to OpenAI. | Interview audio, the transcripts produced from it, and the prompts built from transcripts and rubrics. | United States | EU SCCs (Module Three) plus the UK Addendum. |
| Microsoft Azure Communication ServicesMicrosoft Corporation | Carries real-time audio and video for the embedded Itya interview room, and streams the consented audio leg to our capture endpoint. | Interview audio and video in transit, participant display names, and call-lifecycle metadata. | The Azure region of the ACS resource configured for the deployment. | Microsoft Products and Services DPA incorporating the EU SCCs, plus the UK Addendum. |
| Amazon Web Services (SES)Amazon Web Services, Inc. | Delivery of transactional email: interview invitations, verification and password mail, notifications and data-request correspondence. | Recipient name and email address, message subject and body, and delivery/bounce events. | The SES sending region configured for the deployment. | AWS DPA incorporating the EU SCCs, plus the UK Addendum. |
| StripeStripe, Inc. / Stripe Payments Europe, Ltd. | Subscription billing, hosted checkout, the customer billing portal, invoices and receipts. | Billing contact name and email, billing address, subscription and invoice records. Card details are collected by Stripe and never reach Itya. | United States and Ireland | Stripe DPA incorporating the EU SCCs, plus the UK Addendum. |
| SlackSlack Technologies, LLC (Salesforce, Inc.)Conditional | Delivers workspace notifications to a Slack channel.Only when a workspace connects Slack and enables Slack notifications. | Notification content, which can reference candidate names, roles and interview outcomes. | United States | Salesforce DPA incorporating the EU SCCs, plus the UK Addendum. |
| ZendeskZendesk, Inc.Conditional | Mirrors support requests into a ticketing system so they can be worked and answered.Only where the deployment routes support requests to Zendesk. | Requester name and email, the message body, and the page the request came from. | The region of the configured Zendesk subdomain. | Zendesk DPA incorporating the EU SCCs, plus the UK Addendum. |
| Google WorkspaceGoogle LLCConditional | Hosts the Itya notetaker identities that join Google Meet interviews, where a deployment enables external meeting capture.Only where external Google Meet capture is enabled. The embedded Itya room does not use it. | Meeting attendance, meeting audio captured under recorded consent. | United States | Google Cloud DPA incorporating the EU SCCs, plus the UK Addendum. |
| Microsoft 365Microsoft CorporationConditional | Hosts the Itya notetaker identities that join Microsoft Teams interviews, where a deployment enables external meeting capture.Only where external Microsoft Teams capture is enabled. The embedded Itya room does not use it. | Meeting attendance, meeting audio captured under recorded consent. | The Microsoft 365 tenant region. | Microsoft Products and Services DPA incorporating the EU SCCs, plus the UK Addendum. |
| ZoomZoom Communications, Inc.Conditional | Carries Zoom-hosted interviews and, where enabled, streams consented meeting audio to Itya through Zoom RTMS.Only where external Zoom capture is enabled. The embedded Itya room does not use it. | Meeting attendance, meeting audio captured under recorded consent. | United States | Zoom DPA incorporating the EU SCCs, plus the UK Addendum. |
| Amazon Web Services (S3)Amazon Web Services, Inc.Conditional | Object storage for uploaded resumes and attachments, interview audio, transcript exports, audit archives and data-request bundles, where the deployment points its object-store endpoint at Amazon S3 rather than at the self-hosted store.Only where the object-store endpoint is Amazon S3. The reference single-host deployment uses an S3-compatible store on its own infrastructure. | Resume and attachment files, interview audio, transcript and export files, and data-subject export bundles. | The bucket region the deployment configures. Absent an explicit region the SDK default is us-east-1, so a deployment that requires EU storage must set the region and the bucket deliberately. | AWS DPA incorporating the EU SCCs, plus the UK Addendum. |
| DeepgramDeepgram, Inc.Conditional | Speech-to-text with speaker diarisation, turning interview audio into the transcript the scorecard is evidenced against.Only where the deployment selects Deepgram as its transcription vendor. | Interview audio, and the transcript text derived from it, including anything a participant says. | United States | Deepgram DPA incorporating the EU SCCs, plus the UK Addendum. |
| AssemblyAIAssemblyAI, Inc.Conditional | Speech-to-text with speaker diarisation, as an alternative to Deepgram.Only where the deployment selects AssemblyAI as its transcription vendor. | Interview audio, and the transcript text derived from it, including anything a participant says. | United States | AssemblyAI DPA incorporating the EU SCCs, plus the UK Addendum. |
| Recall.aiRecall.ai, Inc.Conditional | Hosted meeting bot that joins an external Google Meet, Microsoft Teams or Zoom interview and returns its audio and transcript.Only where external meeting capture is enabled and the hosted capture lane is selected. The embedded Itya room does not use it. | Interview audio and video, participant display names, and meeting metadata. | The Recall region configured for the deployment. | Recall.ai DPA incorporating the EU SCCs, plus the UK Addendum. |
| Greenhouse, Lever, Ashby and WorkableGreenhouse Software, Inc. / Lever, Inc. / Ashby, Inc. / Workable Software Ltd.Conditional | Two-way applicant-tracking sync: importing candidates and applications, and pushing stage changes, scorecards and interview evidence back to the system of record.Only where a workspace administrator connects that ATS and enables the corresponding sync direction. | Candidate name, email, phone, resume URL, application stage, and the interview evidence a workspace chooses to push back. | The region of the customer-connected ATS account. | Governed by the customer's own agreement with the ATS vendor. What leaves the workspace is bounded by the connection's sync settings. |
Every subprocessor is engaged under a written contract with data-protection obligations no less protective than the data processing addendum, and Itya remains fully liable to you for their performance.
What is not on this list
Systems you connect yourself are not Itya subprocessors. You are already the controller of that system, and connecting it is your instruction to move data there:
- Google Calendar and Google Meet, connected by a workspace member through OAuth
- Microsoft Outlook Calendar and Microsoft Teams, connected by a workspace member through OAuth
- Zoom, connected by a workspace member
- Greenhouse, Lever and Ashby applicant tracking systems, connected by a workspace administrator
- Slack, connected by a workspace administrator
Itya also does not use an advertising network, a marketing analytics platform, a session recorder, or a data broker. The public site sets no advertising or cross-site tracking cookies — see the cookie policy for the complete inventory.
Notification of changes
Before a new subprocessor starts processing customer personal data, Itya gives at least 30 days' notice and updates this page.
To be notified, email legal@itya.ai asking to be added to the subprocessor notification list, and give us the address that should receive it. Notices go out to that list, not only to the workspace owner, so a privacy or vendor-management team can subscribe directly.
If you reasonably object to a new subprocessor on data-protection grounds within the notice period, raise it with us. If we cannot agree on a resolution, you may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused term.
Change log
Every change to the list above is recorded here with the date it was published, so the notice commitment is something you can check rather than something you have to take on trust. Compare it against the list you reviewed when you signed.
· added
Deepgram, AssemblyAI, Recall.ai
Named the speech-to-text and hosted meeting-bot vendors that receive interview audio when a deployment selects them. They were reachable in the product before they were listed here.
· added
Greenhouse, Lever, Ashby and Workable
Listed the applicant-tracking vendors as subprocessors rather than only as customer-directed integrations: an outbound sync sends candidate records from the workspace to them.
· added
Amazon Web Services (S3)
Separated object storage from email. AWS was listed for SES only, while a deployment can point the object store — resumes, interview audio, transcripts, exports — at Amazon S3.
· amended
Oracle Cloud Infrastructure
Narrowed the object-storage claim: OCI hosts the reference deployment, but the object store is an endpoint choice and can be Amazon S3.
· added
Initial published list
First publication of the subprocessor list alongside the DPA and the privacy policy.
Where processing happens
The location column above records the region each subprocessor processes in. Where that is outside the EEA, the UK or Switzerland, the transfer is covered by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss adaptations, as set out in the transfers section of the DPA.
Hosting region is a deployment choice. If your rollout requires processing to stay in a particular region, tell us before you subscribe so we can confirm what is possible rather than tell you afterwards.