HONE — SUB-PROCESSORS
Lives at: https://hone.detecktiv.io/legal/sub-processors Provider: Virtual Data Integration Ltd (trading as "Hone"), company number 16747738, registered office 22 Walbank Grove, Shenley Brook End, Milton Keynes, MK5 7WB. Version 1.1 — effective on publication
This page lists the third-party sub-processors that Virtual Data Integration Ltd ("Hone", "we") engages to process personal data on behalf of our business customers in providing the Hone service. It is the authoritative and current list referred to in our Terms of Service and Data Processing Agreement (Annex 3).
We engage sub-processors under a general written authorisation. We remain responsible for our sub-processors' compliance with the data protection obligations that apply to us under the DPA. Each sub-processor is bound by a written contract imposing data protection terms no less protective than those in our DPA.
Current sub-processors
| Sub-processor | Purpose / processing activity | Personal data processed | Primary processing location | Transfer safeguard |
|---|---|---|---|---|
| Lovable (Lovable Labs, Inc.) | Application hosting, build and deployment; managed cloud layer that provisions the database and edge below | All Customer Data (as the hosting platform) | Platform: US. Data at rest in Supabase (EU — Ireland) | UK IDTA / SCCs + UK Addendum |
| Supabase (provisioned via Lovable Cloud) | Managed PostgreSQL database, file/object storage and authentication (candidate records, CV documents, account data) | All Customer Data; account credentials | EU — Ireland (AWS eu-west-1) | None required (UK ⇄ EEA adequacy) |
| Cloudflare | CDN, edge network, DNS, WAF, bot protection (Turnstile) | Technical data, IP addresses, data in transit | Global edge (US company) | UK IDTA / SCCs + UK Addendum |
| Anthropic | AI model provider — CV parsing, natural-language search, generation | CV / candidate content submitted for the requested AI action | US | UK IDTA / SCCs + UK Addendum |
| Voyage AI | AI embeddings powering semantic candidate search | CV / candidate text sent to generate search embeddings | US | UK IDTA / SCCs + UK Addendum |
| Google (Drive, Gmail, Calendar APIs) | User-initiated CV import from Drive; optional inbox/calendar connection | Files, emails or calendar data the user chooses to connect | US / global | UK IDTA / SCCs + UK Addendum |
| Stripe | Payment processing and billing | Billing contact details, payment metadata (card data handled by Stripe as its own controller / PCI processor) | US + EU (Ireland) | UK IDTA / SCCs + UK Addendum |
| Twilio | SMS delivery to candidates | Candidate name, phone number, message content | US | UK IDTA / SCCs + UK Addendum |
| Resend | Transactional and service email delivery | Recipient email address, email content metadata | US (AWS SES) | UK IDTA / SCCs + UK Addendum |
| Sentry | Application error and performance monitoring | Technical/diagnostic data, which may incidentally include limited personal data in error context | US | UK IDTA / SCCs + UK Addendum |
| PostHog | Product analytics — usage of the Hone application (consent-gated; opaque user/workspace IDs only, no candidate data) | Usage/event data; opaque account-user identifier | EU (eu.i.posthog.com) | None required (EU-resident) |
| Plausible | Privacy-first, cookieless analytics on the public marketing/sign-up pages only | Aggregated, anonymous site metrics — no cookies, no personal data | EU | None required |
Note on AI providers: Customer Data sent to Anthropic and Voyage AI is processed only to return results for the requesting action. We do not permit these providers to use Customer Data to train their models, and we do not use Customer Data to train any AI model. We do not use OpenAI.
Not a sub-processor of Customer Personal Data: we use Firecrawl to gather public job-board and tender listings into a shared catalogue. It does not process any candidate or Customer Personal Data, so it is not listed as a sub-processor of Customer Data.
Changes to this list
We will update this page when we add or replace a sub-processor. Customers who have subscribed to change notifications, and Enterprise customers with a signed DPA, will be notified in accordance with the DPA before a new sub-processor starts processing, giving a reasonable period to object on legitimate data protection grounds.
To subscribe to sub-processor change notifications, contact privacy@detecktiv.io.