Subprocessors
Last updated: April 2026
Introduction
Cognaium AI Pvt. Ltd. engages carefully vetted third-party vendors (“subprocessors”) that receive or process personal data on our behalf to deliver the platform. This page lists those subprocessors, the services they provide, categories of data involved, and where processing typically occurs. We maintain this register to support transparency obligations under GDPR Article 28, ISO/IEC 27018, and common enterprise due-diligence expectations.
We enter into data processing agreements (DPAs) or equivalent contractual safeguards with subprocessors where they act as processors, and we assess security and compliance before onboarding or materially changing a subprocessor relationship.
Subprocessor register
| Subprocessor name | Service provided | Data processed | Location | DPA status |
|---|---|---|---|---|
| OpenAI | AI assessment scoring, resume parsing, identity verification (fallback) | Assessment answers, resume text, government ID images (fallback) | United States | In place |
| Anthropic (Claude) | AI assessment scoring (fallback) | Assessment answers, conversation context | United States | In place |
| Google (Gemini) | Identity verification (primary), AI scoring (alternative) | Government ID images, selfie photos, candidate names | United States | In place |
| Amazon Web Services (AWS) | Cloud infrastructure, S3 file storage | All platform data, uploaded files, resumes | United States (configurable) | In place |
| Stripe | Payment processing | Billing information, organization email | United States | In place |
| Resend | Transactional email delivery | Recipient email, name, email content | United States | In place |
| Keycloak | Identity and access management | User credentials, session data | Self-hosted | N/A (self-hosted) |
| Pinecone | Vector database for search | Embedding data (derived from content) | United States | In place |
| HuggingFace | Speech-to-text, text-to-speech | Audio content for training features | United States | In place |
| External Proctoring Service | Assessment integrity monitoring | Webcam frames, session data | Configured per deployment | In place |
Changes to this list
We may add or replace subprocessors as our services evolve. When we make a material change, we will update this page and notify customers as described in our agreements and applicable law—for example, via email to account administrators or through in-product notices, with reasonable advance notice where required.
Questions and related policies
For questions about subprocessors or data processing, contact [email protected]. For broader privacy practices, see our Privacy Policy.