Legal

Sub-processors

Last updated 10 September 2026

Written by the Krudo team, not yet reviewed by an external lawyer. It describes what the product does today, measured against the code, and we would rather publish that than a polished document nobody checked.

Third parties that receive data when Krudo runs. Some of them run the service; most of them are services a single check queries, and they appear here because a check that asks a question about an application has to send something to ask it. Each row says what leaves Krudo. Updated with 30 days' notice before any addition; customers with a data processing agreement can object in writing.

This list is not maintained by hand. It is generated from a declaration that the product's own test suite checks against every external address in the source code, so a service cannot be added to Krudo without appearing on this page.

Running the service

Providers that operate Krudo itself. They can hold workspace data and assessment results at rest or in transit.

Sub-processorPurpose, and what it receivesLocationTransfer safeguard

Server hostingRuns the Krudo service and holds its database, the stored applications and the documents downloaded from your applicant tracking system. Receives everything Krudo stores.EUNo transfer: the machine and its backups stay in the EU

CloudflareThe public entry point. Terminates TLS and carries every request to the server, so it sees request metadata in transit: your analysts' IP addresses, the URLs they open, the headers. Also answers the DNS lookups a check makes on an e-mail domain.EU / USStandard Contractual Clauses

ClerkSign-in and session tokens for your team. Receives your analysts' names and work e-mail addresses. Receives nothing about a candidate.USStandard Contractual Clauses

Object storage for off-box backupsHolds encrypted replicas of the workspace database, when a workspace has off-box backup switched on. Off by default. The store is chosen per customer and named in your order form.Chosen per customerStandard Contractual Clauses when the store is outside the EU

Your applicant tracking system

Not our sub-processors: your own systems, and your contract with them. Listed because Krudo connects to them on your instruction, and because the direction of travel matters. Krudo reads applications from them and writes a result field back. It sends them no data of its own.

SystemPurpose, and what it receivesLocationTransfer safeguard

AshbyReads applications, candidates and their attached documents. Writes a result tag back.Your Ashby accountYour own contract with Ashby

GreenhouseReads applications, candidates and their attached documents. Writes a result field back.Your Greenhouse accountYour own contract with Greenhouse

LeverReads opportunities, contacts and their attached documents. Writes a result field back.Your Lever accountYour own contract with Lever

BullhornReads candidates and their attached documents. Writes a result field back.Your Bullhorn clusterYour own contract with Bullhorn

ManatalReads candidates and their attached documents. Writes a result tag back.Your Manatal accountYour own contract with Manatal

Services a check queries

A check compares what an application states against sources anyone can query. Each row names what leaves Krudo. Some rows only run when your workspace holds that provider's key; where that is the case the row says so.

Sub-processorPurpose, and what it receivesLocationTransfer safeguard

IPQualityScoreReputation of an e-mail address and of a telephone number. Receives the e-mail address, or the number. Runs only with a key.USStandard Contractual Clauses

HunterDeliverability of a professional e-mail address. Receives the e-mail address. Runs only with a key.EU (France)No transfer: processing stays in the EU

EmailRepPublic reputation of an e-mail address. Receives the e-mail address.USStandard Contractual Clauses

KickboxTells whether a mail domain is a disposable-address service. Receives the domain only, never the address in front of it.USStandard Contractual Clauses

Gravatar (Automattic)Whether a public avatar profile exists for an address. Receives an MD5 hash of the e-mail address, not the address itself.USStandard Contractual Clauses

Have I Been PwnedWhether an address appears in known breach corpora. Receives the e-mail address. Runs only with a key.US / AUStandard Contractual Clauses

XposedOrNotBreach exposure of an address. Receives the e-mail address.USStandard Contractual Clauses

Hudson RockWhether an address appears in infostealer logs. Receives the e-mail address.IL / USStandard Contractual Clauses

LeakCheckBreach exposure of an address. Receives the e-mail address. Runs only with a key.EUNo transfer: processing stays in the EU

AbstractAPIValidity, carrier and country of a telephone number. Receives the number.USStandard Contractual Clauses

RDAP (registry lookup)Age and registrar of a domain, used on the domain of an e-mail address or of a claimed employer. Receives the domain name only.Global registry networkStandard Contractual Clauses

GitHubWhether a public account matches the address or username on the application, and what it contains. Receives the e-mail address or the username.USStandard Contractual Clauses

LinkedInReads the public profile the application links to, from the recruiter's own browser session. Receives the profile address that was opened.US / IEStandard Contractual Clauses

OpenPGP key serversWhether a public key is published for an address. Receives the e-mail address. Two servers are queried: keys.openpgp.org and the Ubuntu key server.EU / globalStandard Contractual Clauses

WhatsMyNameWhere a username exists across public sites. Receives a username derived from the part of the e-mail address before the at sign, never the address. That service queries several hundred sites of its own.USStandard Contractual Clauses

Yandex ImagesReverse image search on a profile photograph, run from the recruiter's own browser. Receives the address of the photograph, which its servers then fetch.RU / NLStandard Contractual Clauses. No adequacy decision covers Russia

Nominatim (OpenStreetMap Foundation)Turns a place name into a country. Receives the location line as the application writes it, and nothing that identifies whose it is.EU (UK / DE)UK adequacy decision

ip-api.comCountry, network and carrier behind the IP address your applicant tracking system recorded when the application was submitted. Receives that IP address.DENo transfer: processing stays in the EU

GitHub (public file download)Downloads a public list of datacentre and VPN address ranges, refreshed periodically. Sends nothing about any candidate: it is a file fetch.USNothing personal is sent

Consumer platform sign-in endpointsAsks each platform whether an address is already registered, the way its own "forgotten password" form does. Each receives the e-mail address. This runs only in the recruiter's browser, never from our servers, and only on a full analysis.WorldwideNo contract: these are public sign-in endpoints, not vendors of ours

Off unless you turn them on

Employer and school verification is behind a switch that is off in the shipped configuration (the four FD_ENABLE_ flags in sync-server/scorer.js). Nothing below is contacted until it is on.

Sub-processorPurpose, and what it receivesLocationTransfer safeguard

Annuaire des entreprises (data.gouv.fr)Whether a French employer exists and since when. Receives the employer name.FRNo transfer: processing stays in the EU

GLEIFLegal-entity records for a claimed employer. Receives the employer name.EU (DE)No transfer: processing stays in the EU

Wikidata (Wikimedia Foundation)Founding year and country of a claimed employer. Receives the employer name.USStandard Contractual Clauses

UK Companies HouseRegistration of a UK employer. Receives the employer name. Runs only with a key.UKUK adequacy decision

crt.sh (Sectigo)Certificate history of an employer domain, which dates the domain. Receives the domain name.USStandard Contractual Clauses

Internet ArchiveWhen an employer site was first archived, which dates the company. Receives the domain name.USStandard Contractual Clauses

The 132 platform probes

One row above covers 132 consumer platforms: streaming services, shops, developer sites, learning sites, social networks. Krudo asks each of them the question their own "forgotten password" form asks, which is whether an address is already registered. That is how a brand-new identity with no history anywhere becomes visible. It runs only in the recruiter's browser, never from our servers, and only when they ask for a full analysis. A quick analysis queries 12 of them.

These are not vendors of ours and there is no contract with them. The e-mail address on the application reaches each one, in the same request an ordinary visitor's browser would make. The full list is in the product's source, one file per platform, and the number above is read from it: adding a platform changes the number on this page.

Links, which are not sub-processors

Krudo also builds links a recruiter can open to check something themselves. Krudo never calls these hosts. Their servers see nothing until someone clicks, and then it is that person's own browser that connects. We list them anyway, because what one click sends is worth knowing.

DestinationWhat the click sends

Google searchThe e-mail address or the telephone number, in the query

Google LensThe address of the profile photograph

TinEyeThe address of the profile photograph

PimEyes, FaceCheckNothing: the link opens the site's home page, with no query

Truecaller, NumLookup, Sync.me, WhoscallThe telephone number, in the query

CredlyThe certificate number printed on the CV

Questions about this document: legal@krudo.ai · Data requests: privacy@krudo.ai · Security: security@krudo.ai