Sub-processors
The companies that help us run oryx
oryx | oryx.so/sub-processors
Version 1 | Effective Date: September 2026
00
How we use sub-processors
oryx uses a small number of vendors to run the platform. Where any of them handles personal data on behalf of our customers, they are a sub-processor and they appear on this page.
Every sub-processor is bound by a written agreement that requires them to process data only on our instructions, to apply appropriate security measures, and to never use the data for their own purposes. None of them may sell it, and none of them may use candidate data to train AI models.
We give 30 days notice before adding a new sub-processor. Customers on a paid subscription can object during that period by writing to privacy@oryx.so. If we cannot resolve an objection, you may terminate the affected part of your subscription without penalty.
To be notified of changes to this page, email privacy@oryx.so with the subject "sub-processor updates".
01
Infrastructure and storage
1.1
Supabase
What it does: database and file storage. All candidate records, application answers, resumes and documents are held here
Data processed: all candidate and business account data
Location: [CONFIRM REGION]
Transfer mechanism: [CONFIRM - Standard Contractual Clauses if outside the EEA]
Their terms: supabase.com/legal/dpa
1.2
Vercel
What it does: hosts and serves the oryx application
Data processed: data in transit, request logs, IP addresses
Location: [CONFIRM REGION]
Transfer mechanism: [CONFIRM]
Their terms: vercel.com/legal/dpa
1.3
Framer
What it does: hosts the oryx.so marketing website
Data processed: website visitor data only. No candidate or account data
Location: [CONFIRM REGION]
Their terms: framer.com/legal/dpa
03
Artificial intelligence
3.1
Anthropic
What it does: generates draft job advertisements and interview questions, and summarises interview notes written by an employer's team
Data processed: the text an employer submits to those features. AI is not used to score, rank, filter or disqualify candidates
Location: United States
Transfer mechanism: Standard Contractual Clauses
Training: contractually barred from training models on data submitted through oryx
Their terms: anthropic.com/legal/commercial-terms
04
Billing
4.1
Stripe
What it does: processes subscription payments and issues invoices
Data processed: billing contact name, email address, company name, and payment method details. Card and banking details are held by Stripe, never by oryx. No candidate data
Location: United States
Transfer mechanism: Standard Contractual Clauses
Their terms: stripe.com/legal/dpa
05
Analytics
5.1
Google Analytics
What it does: measures how visitors use the oryx.so website
Data processed: website visitor data only. It does not run on application forms or interview pages
Location: United States
Transfer mechanism: Standard Contractual Clauses
Their terms: business.safety.google/processorterms
06
Not sub-processors
Some tools we use internally never touch data held on behalf of our customers, so they do not appear above. Our own CRM, accounting software and internal communication tools hold information about our business contacts and our own staff, for which oryx is the controller. They are covered by our Privacy Policy rather than by this page.
07
Questions
For a copy of our Data Processing Agreement, a security questionnaire response, or details of any sub-processor listed above, contact info@oryx.so.
