What this page is
Hivemind, the hiring OS, uses a small number of third-party providers to run the Services. Each one that receives Customer Data is a sub-processor under the Data Processing Addendum, listed here with its role, the data it receives, and its processing location. This page governs where it and the copy attached to a customer's agreement differ.
Every sub-processor is bound to obligations no less protective than the DPA, and Hivemind remains liable for their performance.
Sub-processors
| Provider | What it does for Hivemind | Data it receives | Processing location | Model training and retention |
|---|---|---|---|---|
| Amazon Web Services (S3, database, Transcribe) AI provider | Hosting; storage of CVs and recorded video answers; backups; speech to text for interview answers and meeting recordings | All Customer Data | United States (us-west-2, Oregon) | Hivemind applies the AWS AI services opt-out policy to its account |
| OpenAI (gpt-3.5-turbo, gpt-4o-mini, gpt-4o, gpt-4, gpt-realtime) AI provider | CV scoring and parsing; coding answer grading; personality evaluation; live AI voice interviews and their feedback; meeting summaries; question and assessment generation; candidate search; pipeline generation | CVs, answers, transcripts, live interview audio | United States | Zero data retention, no training |
| Google (Gemini API, gemini-2.5-pro) AI provider | Grading written open-ended answers and video and audio interview answers | Answer text and transcripts | As published | Paid tier: Google does not use the data to improve its products; prompts may be logged for a limited period for abuse monitoring |
| Vapi AI provider | AI voice phone screens: call handling, recording, transcription, evaluation | Audio, recordings, transcripts, phone numbers | United States | Records calls by default and keeps recordings and transcripts under Vapi's own terms, which permit use to improve its models; no zero-retention arrangement on Hivemind's plan |
| Cartesia Service | Synthetic voices for AI phone screens | Agent speech text only, no Customer Data | As published | Not applicable |
| Deepgram (Nova 3), engaged through Vapi AI provider | Speech to text on phone screens | Audio | As published | Under Vapi's terms; no zero-retention arrangement |
| Twilio Service | SMS; phone numbers for AI and recruiter calls; call recordings; phone number verification | Phone numbers, message content, call audio | United States | Not applicable |
| SendGrid Service | Candidate email sending | Email addresses, message content | United States | Not applicable |
| Unipile Service | LinkedIn and WhatsApp messages | Profile identifiers, message content | France | Not applicable |
| PostHog (US cloud) Service | Screen recording of assessment sessions; product analytics | On-screen activity on assessment pages | United States | Not applicable |
| SessionRewind Service | Screen recording of assessment sessions | On-screen activity on assessment pages | As published | Not applicable |
| Crisp Service | Support chat in the app and on candidate pages | Chat content, contact details | European Union (Netherlands, Germany) | Not applicable |
| Goody Service | Gift sending, when a Customer sends a gift | Candidate name and delivery details | United States | Not applicable |
| People Data Labs, Apollo.io Service | Enrichment of candidate profiles | Names, employers, contact details | United States | Not applicable |
| cal.com Service | Interview scheduling | Name, email, availability | United States | Not applicable |
| New Relic, Datadog Service | Logging, monitoring, and alerting | Technical logs, which include Customer Data such as call transcripts and grading output | As published | Not applicable |
| Google reCAPTCHA Service | Spam protection on application forms | Device and interaction data | United States | Not applicable |
| Stripe Service | Customer subscriptions and credits | Customer billing data only, no Candidate Data | United States | Not applicable |
Hivemind processes Customer Data in the United States (Amazon Web Services us-west-2, Oregon) and through the sub-processors above in the locations listed for each. "As published" means the location the provider publishes for its service.
AI and voice providers
Hivemind does not use identifiable Customer Data to train any model that serves other customers, and does not license any recording of a call, interview, or meeting for training, unless the Customer opts in. Vapi, which runs AI phone screens, keeps recordings and transcripts under its own terms, which permit it to use them to improve its models, and Hivemind has no zero-retention arrangement with Vapi. For each AI provider the account setting is:
- Amazon Web Services (S3, database, Transcribe): Hivemind applies the AWS AI services opt-out policy to its account.
- OpenAI (gpt-3.5-turbo, gpt-4o-mini, gpt-4o, gpt-4, gpt-realtime): Zero data retention, no training.
- Google (Gemini API, gemini-2.5-pro): Paid tier: Google does not use the data to improve its products; prompts may be logged for a limited period for abuse monitoring.
- Vapi: Records calls by default and keeps recordings and transcripts under Vapi's own terms, which permit use to improve its models; no zero-retention arrangement on Hivemind's plan.
- Deepgram (Nova 3), engaged through Vapi: Under Vapi's terms; no zero-retention arrangement.
Integrations you activate
Integrations the Customer activates are not Hivemind sub-processors and act under the Customer's own agreements: the Customer's mailbox (Gmail, Microsoft Graph, SMTP or IMAP), Zoom, Google Meet, and Microsoft Teams recordings, Ashby, Greenhouse, Slack, Zapier, customer webhooks, and a Customer's own OpenAI account.
Hivemind's own sales tooling (Lemlist, Smartlead, MillionVerifier, the Apollo dialer) processes Hivemind's business-contact data as described in the Privacy Policy section 5 and does not touch Customer Data.
Changes and notice
Hivemind may appoint a new sub-processor. It gives at least 30 days' notice by email to the account owner and to anyone subscribed on this page before the new sub-processor processes Customer Data. A customer may object within that period on reasonable data-protection grounds under section 5.2 of the DPA.
Get an email before any change to this list.
Questions about a sub-processor, a data location, or the DPA.
accounts@gethivemind.ai