Sub-processors
Version 1.4-pilot · Effective 2026-10-30
These are the service providers that may process personal data for Arcanext, with what each one does, the data it handles and where. They are authorized by the Data Processing Addendum. During the closed pilot, voice calling, candidate messaging and text interviews are switched off: Arcanext does not call, text or email candidates, and no candidate data is sent to Twilio, Deepgram or Cartesia or through Resend.
Sub-processor list
| Sub-processor | Purpose | Data categories | Region | Encryption at rest |
|---|---|---|---|---|
| Microsoft Azure | Application hosting and storage: the arcanext.com web application and the API on Container Apps, Azure Database for PostgreSQL, Blob Storage, Service Bus, Key Vault, and Azure Managed Redis for rate limiting; live call state and latency metrics in Azure Managed Redis, only if voice screening is enabled |
| Central US and East US 2 | AES-256 (documented by the provider) |
| Azure OpenAI | Résumé parsing and extraction, embeddings and match explanations for résumé matching, and drafting job descriptions, interview questionnaires and scoring rubrics; in-call conversation steering, only if voice screening is enabled; interview answer extraction and scoring, only if voice screening or text interviews are enabled; reading a requested call-back time from candidate email replies, only if messaging is enabled |
| East US 2 (resource); Global Standard deployments, so prompts and completions may be processed in any Azure region where the model is available, while stored data stays in the resource's geography (United States) | Not stated |
| Clerk | Customer user sign-in, organization membership and sessions |
| United States; Clerk may also process data where its sub-processors operate | Not stated |
| Twilio | Placing screening phone calls and streaming call audio; sending and receiving candidate SMS messages, only if messaging is enabled |
| United States | Not stated |
| Deepgram | Speech-to-text and text-to-speech during screening calls |
| Global endpoint (api.deepgram.com), for which Deepgram states no fixed processing geography | AES-256 (documented by the provider) |
| CartesiaOnly if enabled | Text-to-speech during screening calls, only if enabled |
| Not used unless enabled; no data is sent to Cartesia while it is not enabled | Not stated |
| Resend | Transactional email delivery; receiving candidate email replies, only if messaging is enabled |
| United States | AES-256 (documented by the provider) |
| Sentry | Error monitoring, with personal data scrubbed before sending |
| United States | Not stated |
| Razorpay | Subscription and credit payments |
| India | Not stated |
| GitHub | Source code hosting and continuous integration |
| United States | Not stated |
Security in transit and at rest
Data Arcanext sends to these providers is protected in transit with TLS 1.2 or higher. "AES-256 at rest" is shown only where the provider's own documentation states it.
Azure OpenAI does not use customer data to train models; prompts may be retained for up to 30 days for abuse monitoring.
Before a candidate gives permission to record
The Privacy Notice (arcanext.com/privacy) and the AI notice (arcanext.com/ai-notice) tell candidates: "Before you give permission to record, the first few words of your first one or two replies may be sent to Azure OpenAI solely to detect an answering machine. They are not recorded or stored by us; Azure OpenAI may keep them for up to 30 days for abuse monitoring."
Changes to this list
Arcanext gives customers 30 days' prior notice before adding or replacing a sub-processor, as set out in the Data Processing Addendum.