Novatree runs on Amazon Web Services. This is the complete list of third parties that can process customer personal data on our behalf.
Draft — pending legal review
This document is published for transparency and is not yet final. Highlighted items are still to be completed.
Each sub-processor is bound by written terms that protect personal data at least as well as our Data Processing Agreement. Customer data is stored in the United States.
| Sub-processor | Service | Purpose | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Amazon ECS (Fargate), Elastic Load Balancing | Runs the application | United States (us-east-2) |
| Amazon Web Services, Inc. | Amazon CloudFront | Delivers the web application and terminates TLS close to the user | Global edge network |
| Amazon Web Services, Inc. | Amazon DynamoDB | Primary database for all workspace records | United States (us-east-2) |
| Amazon Web Services, Inc. | Amazon S3, AWS KMS | Stores uploaded files and interview recordings, encrypted | United States (us-east-2) |
| Amazon Web Services, Inc. | Amazon SES | Sends email: sign-in links, notifications, candidate messages | United States (us-east-2) |
| Amazon Web Services, Inc. | Amazon Bedrock | Foundation models for AI features; inputs are not used for model training | United States |
| Amazon Web Services, Inc. | Amazon Transcribe | Transcribes recorded interviews | United States (us-east-2) |
| Amazon Web Services, Inc. | Amazon CloudWatch, AWS Secrets Manager | Operational logs, metrics and alarms; storage of application secrets | United States (us-east-2) |
| Stripe, Inc. | Stripe Billing and Checkout | Processes subscription payments; receives billing contacts only, never candidate or employee data | United States |
The providers below are not our sub-processors. Nothing is shared with them unless a workspace administrator connects them, and then data is exchanged on your instruction, under your own agreement with that provider.
| Provider | What the integration does |
|---|---|
| Google Workspace | Calendar availability and interview scheduling; Google Meet links |
| Microsoft 365 | Outlook calendar availability and interview scheduling |
| Slack | Notifications, approvals and the assistant inside your Slack workspace |
| Workday, BambooHR, UKG | Importing your employee census and writing back hiring outcomes |
| Greenhouse | A one-time import of your existing hiring data when you move to Novatree |
| Your identity provider | Single sign-on (OpenID Connect) |
We will update this page, and notify customers who have asked to be told by email, at least 30 days before a new sub-processor begins processing customer personal data. A customer may object on reasonable data-protection grounds within that period, as the Data Processing Agreement describes. To subscribe to notifications, email privacy@novatree.ai.
This page is provided for general information and to support customer due diligence. It is not legal advice. Novatree.ai should have this document reviewed by qualified privacy counsel before it is relied upon, particularly regarding GDPR/UK GDPR, CCPA/CPRA, and jurisdiction-specific employment-data obligations.