Last updated: 14 October 2026 · Live working version — some regions/safeguards confirmed from each vendor's public DPA; items still marked “to confirm” are pending vendor/engineering confirmation.
All Umamy-controlled storage and compute are in the EU. Transfers outside the EU are limited to specific AI/SaaS providers and are each framed under an appropriate safeguard, following this order of preference: (1) EU hosting = no transfer; (2) EU Commission adequacy decision; (3) EU-US Data Privacy Framework (DPF) self-certification; (4) Standard Contractual Clauses (SCC) + a positive Transfer Impact Assessment (TIA).
| Sub-processor | Purpose | Data region | Transfer outside EU | Safeguard |
|---|---|---|---|---|
| Amazon Web Services | Core platform (database, compute, storage) | EU — Frankfurt (eu-central-1) | No | EU hosting · ISO 27001 / SOC 2 |
| AWS Bedrock AgentCore | Agent runtime & memory | EU — Frankfurt | No | EU hosting · AWS DPA |
| Railway | Frontend hosting | US by default (infra on Google Cloud) — EU data residency available on paid tier | Yes, unless an EU region is used — to confirm which region we run | Per Railway public DPA: DPF or SCC (Dec. 2021/914, Modules 2–3). Railway Corporation (US). |
| Supabase | Authentication & frontend database | EU (data at rest in the selected EU region) | At rest: no; vendor incorporated in Singapore (Supabase Pte. Ltd) | SCC incorporated in Supabase public DPA (Dec. 2021/914, Modules 2–3; acceptance = signature) · SOC 2 Type 2 / ISO 27001 / HIPAA · TIA still to request |
| Unipile | LinkedIn connection & messaging | EU (France) | No | EU hosting · SOC 2 Type II · DPA |
| Unified.to | ATS aggregation (push on client instruction) | EU | No | EU hosting · DPA |
| Microsoft Azure OpenAI | Primary LLM inference | EU (Sweden Central) | No (EU Data Boundary) | Microsoft DPA. Note: GlobalStandard SKU may route processing outside the EU; DataZoneStandard available for strict EU-only. |
| OpenAI | LLM inference — fallback only (when Azure fails) | US | Yes | DPF + SCC + zero-retention DPA. Scheduled for removal after full Azure migration. |
| PostHog | Prompt registry, LLM tracing, feature flags | EU — Frankfurt (PostHog EU Cloud) — confirm our instance is eu.posthog.com | No (EU Cloud); vendor US-incorporated | EU hosting · public DPA available |
| Data-provider partner | Candidate-base enrichment (people & company search) | EU — Frankfurt | At rest: no; US-incorporated vendor | SCC (residual). Serves Umamy's own candidate base (controller-side). |
| Seltz | Web search on candidates' employers | EU (to confirm) | No (if EU) | DPA (to confirm) |
| Slack | Operational error alerts (+ a client agent channel) | US | Yes | DPF + SCC + DPA |
Not in active use: Exa (web search — alternative, kept for comparison); Basalt (disabled).
Not Umamy sub-processors: the client's own ATS (Greenhouse, Lever, Workable, Teamtailor…) and the client's email/messaging tools — operated directly by the client (controller).
To confirm by 16/10 (with Connor / vendors): Railway — region actually used (EU residency vs US default); Unified.to — hosting region + DPA; Seltz — region + confirm no personal data sent (search terms only); PostHog — confirm instance is EU Cloud; Azure — DataZoneStandard SKU migration; Supabase — obtain the TIA; OpenAI & Slack — confirm active DPF self-certification (dataprivacyframework.gov).