Subprocessors
Last updated: October 28, 2026
When an organization uses the sherpa platform, the sherpa entity named in its contract processes personal data on that organization's behalf. To run the platform, we use the service providers below, which process customer personal data for us.
Tools used only for our own website, such as analytics and the booking calendar, are described in our Privacy Policy and are not listed here.
Current subprocessors
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI model inference (Claude) | USA | EU Standard Contractual Clauses |
| Cloudflare, Inc. | DNS, network security and content delivery; storage of database backups (R2) | Global network; backups stored in the EU | EU Standard Contractual Clauses |
| Extend (CrowdView Inc.) | Text extraction from uploaded documents other than PDF | EU (Frankfurt, Germany) | EU Standard Contractual Clauses |
| GitHub, Inc. | Weekly automated test that restores a database backup on a temporary build server | USA | EU Standard Contractual Clauses |
| Google (Gemini API) | AI model inference (Gemini) | Global (Google infrastructure) | EU Standard Contractual Clauses |
| Inngest, Inc. | Background job processing | USA | EU Standard Contractual Clauses |
| Mistral AI SAS | Text extraction (OCR) from uploaded PDF documents | EU (France) | Not required (processing in the EU) |
| OpenAI | AI model inference | USA | EU Standard Contractual Clauses |
| OpenRouter, Inc. | AI model routing: input checks on chat messages, document checks and CV matching | USA | EU Standard Contractual Clauses |
| Railway Corporation | Application hosting and databases | EU (Amsterdam, Netherlands) | EU Standard Contractual Clauses |
| Resend, Inc. | Transactional email (invitations and notifications) | USA | EU Standard Contractual Clauses |
| Sentry (Functional Software, Inc.) | Error monitoring | EU (Germany) | EU Standard Contractual Clauses |
| Tigris Data, Inc. | Storage of uploaded files, as Railway's storage provider | EU (Amsterdam, Netherlands) | EU Standard Contractual Clauses (through our agreement with Railway) |
| WorkOS, Inc. | Sign-in, single sign-on and user management | USA | EU Standard Contractual Clauses |
Changes to this list
We notify customers with a data processing agreement at least 30 days before a material change to this list, such as a new subprocessor. Customers can object to the change under their data processing agreement.
Questions about this list: [email protected].