Subprocessors
Last updated: April 15, 2026
Candor, operated by Highline Beta Inc., uses the third-party service providers listed below ("subprocessors") to deliver the product. Each receives only the data it needs to perform its function.
We commit to providing existing customers at least 30 days’ email notice before adding a new subprocessor that would process their data. Customers under a DPA may object within that window as described in the agreement. Questions: privacy@runcandor.com.
Current subprocessors
| Service | Purpose | Data processed | Location | Legal entity |
|---|---|---|---|---|
| Supabase | Database, authentication, storage | All workspace content, account information, usage logs | United States (AWS us-east-1) | Supabase, Inc. |
| Vercel | Application hosting, serverless compute | Request metadata, IP addresses, app logs | United States (AWS us-east-1) | Vercel Inc. |
| Anthropic | Large-language-model inference (Claude) | Prompts and responses for persona generation and interview simulation | United States | Anthropic, PBC |
| Voyage AI | Embedding generation for uploaded documents | Document chunks submitted for embedding | United States | Voyage AI Innovations, Inc. |
| Tavily | Web search for research evidence retrieval | Industry and region search queries (no personal data) | United States | Tavily AI, Inc. |
| Inngest | Background job orchestration | Job payloads (study IDs, session IDs — minimal metadata) | United States | Inngest, Inc. |
| Resend | Transactional email delivery | Email addresses, subject lines, message bodies | United States | Resend, Inc. |
| OAuth sign-in (optional, when a user chooses Google) | Email address, display name, profile image URL | United States | Google LLC |
Infrastructure (Candor-owned)
In addition to the vendors above, Candor processes data internally using its own application code running on Vercel (hosting) and Supabase (database + storage). No additional third-party processor touches customer data outside the list above.
Recent changes
- April 15, 2026 — Initial publication. Current list: Supabase, Vercel, Anthropic, Voyage AI, Tavily, Inngest, Resend, Google (OAuth only).
For questions about this list or to request our Data Processing Agreement, email privacy@runcandor.com.