Sub-processors
Last updated: September 21, 2026
Arihance Systems Private Limited (CIN U62011DL2026PTC468013) ("CalHire") engages a small set of third parties ("sub-processors") to help deliver the service. Each is named below with what it actually handles. We require each to meet appropriate security and data-protection obligations, consistent with the GDPR, India's DPDP Act, and the UAE PDPL.
1. Communications
| Sub-processor | Purpose | Data it handles |
|---|---|---|
| Microsoft Azure Communication Services | Primary transactional email — sign-in codes, assessment invitations, report cards, notifications | Recipient email address and message content |
| Resend | Fallback transactional email, used when the primary provider is unavailable | Recipient email address and message content |
2. Payments
| Sub-processor | Purpose | Data it handles |
|---|---|---|
| Paddle | Subscription billing and invoicing in every market. Merchant of record | Billing contact, company details, payment method (held by Paddle, never by us) |
We never store card numbers. Payment details are captured by the provider and we hold only the resulting reference.
3. AI model providers
These providers run the skills assessments, the text interview, the job-description generator, and the scoring narratives. None of them ever receives personal identifying information — see section 6.
| Sub-processor | Role |
|---|---|
| Anthropic | Primary model provider for assessment generation, scoring, interviews, and generated copy |
| OpenAI | Fallback provider |
| Fallback provider | |
| Groq | Fallback provider |
| DeepSeek | Fallback provider |
| Moonshot AI (Kimi) | Fallback provider |
A fallback provider is called only when the primary is unavailable or fails a response check. Which provider serves which task is configuration, and this list is the full set that can be reached.
4. Product analytics
| Sub-processor | Purpose | Data it handles |
|---|---|---|
| PostHog (EU region) | Aggregate product usage — which pages and features are used, and where people get stuck | A random identifier created at the moment you consent, the page path, and the named event |
This one is different from the others on this page, in three ways worth stating plainly.
It only runs if you say yes. Nothing is loaded and no identifier exists until you accept analytics in the cookie banner. Decline, or simply ignore the banner, and no event is ever recorded. Withdraw later from "Cookie settings" and it stops immediately, not on your next visit.
The identifier is not you. What we send is a random value generated when you consent. It is not your account id, your email, or anything derived from them, and it cannot be joined back to your CalHire account. The consequence is deliberate: this tool can tell us that a page is confusing and cannot tell us who was confused.
There is no session recording and no autocapture. We do not replay your screen, and we do not record the text of what you click or type. Only a fixed list of named events is collected, and full page addresses are excluded so that nothing in a link can travel with them.
Processing is in the European Union. This is enforced in our build configuration, not merely preferred: a deployment pointed at a non-EU region fails to build.
5. Infrastructure
Cloud hosting, compute, storage, and database services, with in-region residency available for the EU, India, and the UAE. We are finalising our hosting arrangements and will name the provider here, with the regions it serves, before we publish a data-processing agreement. Until then, treat the residency options above as configurable and ask us for specifics if you need them for a review.
6. No personal data to AI models
By design, no AI sub-processor ever receives candidate personal identifying information. Anonymisation is enforced at an architectural boundary before any model is called — it is not a setting, and it does not vary by provider or region.
7. In-region processing
Where you require in-region data residency, we configure infrastructure and providers so that personal data is processed within the EU, India, or the UAE as applicable.
8. Changes and notice
We may update our sub-processors as the service evolves. Material changes are reflected by the "last updated" date above. Customers under an enterprise agreement may request advance notice of new sub-processors as provided in their data-processing terms.
9. Contact
Questions about our sub-processors or data processing? Email privacy@calhire.com.