Sub-processor List
Last updated: 8 February 2026
This page lists the third parties HyreDocs uses to process personal data on behalf of our customers. It forms part of our Data Processing Agreement. We notify customers at least 30 days before adding or replacing a sub-processor — see clause 7 of the DPA for the objection process.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| MongoDB Atlas | Primary database (customer + candidate records, signed documents) | United States (with EU regions available on request) | UK IDTA + SCCs |
| Emergent Labs | Application hosting and ingress (TLS termination) | United States | UK IDTA + SCCs |
| Resend | Transactional email delivery (preview / sandbox environments) | United States | UK IDTA + SCCs |
| Amazon Web Services (SES) | Transactional email delivery (production) | EU-West (Ireland) | Adequacy decision — UK ↔ EU |
| Bullhorn | ATS integration — only where the Customer has connected their Bullhorn account | United States / EU | UK IDTA + SCCs (where applicable) |
How we evaluate sub-processors
- Each vendor signs a written data-processing contract that imposes equivalent obligations to those we owe our customers.
- We assess each vendor's security certifications (SOC 2, ISO 27001, etc.) and incident-response history.
- We perform an annual review of every active sub-processor.
- We use the minimum data necessary for each integration — sub-processors do not receive a full copy of customer records unless their function requires it.
Subscribe to changes
Email contracts@hyredocs.com to be added to our sub-processor change notification list. You will receive at least 30 days' notice before any change takes effect.
Questions? Email privacy@hyredocs.com — we respond within 30 days, as required by GDPR.