Sub-Processor Disclosure
Last updated: June 11, 2026
This page lists every third party that processes personal data on behalf of Driora. We are committed to transparency about who handles your data and under what terms.
Our commitment: We notify users of new sub-processors via email (for waitlist members) or by updating this page before a new processor begins handling personal data. If you have questions about any sub-processor, email [email protected].
| Sub-processor | Purpose | Data Processed | Location | DPA / Privacy Terms |
|---|---|---|---|---|
| Anthropic | AI report generation. Your resume text and job context are sent to the Claude API to produce the career intelligence report. | Resume content (text, PII-redacted before sending), name (optional context) and, for the company-research section, employer-directed web search queries (company name and role context; screened to exclude your personal data) | US | anthropic.com/legal/dpa |
| Resend | Transactional email delivery. Used to send the completed report to your inbox and waitlist confirmation emails. | Email address, name | US | resend.com/legal/dpa |
| Render | Application hosting. Runs the Driora web application and API server. | All data processed by the application while serving requests (transient) | US | render.com/legal |
| Supabase | Primary database (PostgreSQL). Stores the waitlist table and the 24-hour report cache. | Email address, name, phone (optional), LinkedIn URL (optional), resume content (24h), IP address (1h) | US (Virginia) | supabase.com/legal/dpa |
| Upstash | Redis cache and job queue. Stores session state and rate-limit counters. | Session tokens (no plaintext personal data), IP-derived rate-limit keys | US | Upstash DPA (PDF) |
| Cloudflare | DNS, CDN edge caching and email forwarding for the drioracareers.com domain. | IP addresses, request metadata (standard CDN/DNS data) | Global edge | Cloudflare Privacy Policy |
| Sentry | Error monitoring. Captures application exceptions to help us identify and fix bugs. | Anonymized stack traces, request context (may incidentally include partial request data) | US | sentry.io/legal/dpa |
All sub-processors are contractually prohibited from using your data for their own purposes beyond what is described above. Each has executed a Data Processing Agreement (DPA) that incorporates EU Standard Contractual Clauses (SCCs) for international data transfers from the EEA.
For the full picture of how your data is handled, see our Privacy Policy. To exercise data rights, see the Data Request page.