Sub-processors
Version 1.0 · Last changed 6 October 2026
Navigent uses these providers to deliver the service. Most of them process candidate data on our customers' behalf and are sub-processors under the data processing agreement. Some process only Navigent's own data, such as billing or visits to navigent.io, and the Purpose column says so.
| Provider | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, sign-in and file storage for the service | All candidate and account data | EU (Frankfurt) | The European Commission's standard contractual clauses (2021/914) with Supabase Pte. Ltd., Singapore, in Supabase's data processing agreement |
| Vercel | Hosting of navigent.io and app.navigent.io | Requests and logs, including IP addresses | The service's functions run in the EU (Frankfurt). Vercel's primary facilities are in the United States | The EU-U.S. Data Privacy Framework |
| Inngest | Background jobs | IDs and counts in events, never personal data | United States (Amazon Web Services in Ohio and Inngest's own servers in Virginia) | Not applicable: Inngest receives no personal data |
| OpenAI | AI to read job ads, rank and assess candidates, write text for messages and posts, and label replies. For Navigent itself, also the requirements profile tool on navigent.io and the help in the app | Candidates' career data and assessments without names, photos, e-mail addresses or phone numbers, job ads, and the text of candidates' replies. For Navigent itself, the text pasted into the requirements profile tool and questions to the help in the app | OpenAI Ireland Ltd., Ireland | Outside the EEA: the European Commission's standard contractual clauses or an adequacy decision, under OpenAI's data processing agreement |
| Prospeo | Candidate search and e-mail address lookups | Search filters and the profiles and e-mail addresses Prospeo returns, as well as the LinkedIn URL of each removal from the "Remove me from Navigent" page, which is forwarded | United States (Amazon Web Services, us-east-1). Prospeo is Defastra Tech Inc., Canada | The European Commission's adequacy decision for Canada. Onward to Prospeo's providers in the United States: the EU-U.S. Data Privacy Framework where they are certified, otherwise the European Commission's standard contractual clauses |
| Bright Data | Profile photo and "About" text from LinkedIn, for candidates on a role's longlist in workspaces where "Show photos" is on. The photo is copied into Navigent's own storage without its metadata and is never sent to AI | The LinkedIn URLs of those candidates, and the photos and texts fetched | Israel (Bright Data Ltd.). Its systems are hosted at Amazon Web Services, with a disaster recovery site in AWS in the EU and backups at Microsoft Azure | The European Commission's adequacy decision for Israel. Outside the EEA and countries with such a decision: the European Commission's standard contractual clauses under Bright Data's data processing agreement |
| Unipile | Campaigns through the customer's own LinkedIn accounts and Gmail and Outlook mailboxes, the latter two through Unipile's own apps, which Google and Microsoft have verified, and posts about roles on LinkedIn | Access to the connected accounts, messages to and from candidates, the profile information used to contact them, and posts with their reactions and comments, which are read but not stored | France (Scaleway and OVH) | Hosting in the EU. Unipile's providers outside the EU/EEA: an adequacy decision, the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, as Unipile's privacy policy sets them out |
| Resend | E-mail from Navigent: sign-in, invitations and service messages to users, the confirmation of a removal request, and the e-mails of a demo request. Never campaigns | The recipient's e-mail address, their name where we have it, and the e-mail's content, which may name a candidate the user can already see | United States (Plus Five Five, Inc.) | The European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework, under Resend's data processing agreement |
| Google (Google Workspace) | The info@navigent.io mailbox | Enquiries and demo requests, which can carry candidate data a customer sends | The countries where Google and Google's sub-processors have facilities | The EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses in Google's data processing terms |
| Stripe | Payments, subscriptions and invoices. Navigent's own data only | Billing contact, company details, VAT number and payment details | United States (Stripe, LLC). The agreement is with Stripe Payments Europe, Limited, Ireland | The EU-U.S. Data Privacy Framework, otherwise the European Commission's standard contractual clauses |
| Sentry | Errors and logs | Technical data, without personal data | EU (Frankfurt) for errors and logs. Account and organisation details may be kept in the United States | The EU-U.S. Data Privacy Framework, otherwise the European Commission's standard contractual clauses |
| Better Stack | Uptime monitoring and the status page at status.navigent.io | No personal data | EU | The European Commission's standard contractual clauses in Better Stack's data processing agreement |
| Vercel Web Analytics | Visitor statistics for navigent.io. Navigent's own data only | Visits, without cookies and without a cross-site identifier | As for Vercel | As for Vercel |
| MillionVerifier | Verifying candidates' e-mail addresses before sending | Candidates' e-mail addresses | Hungary (GBD Software as a Service Private Limited Company), with providers in the United States, Canada, Germany, France and Sweden, among others | No transfer to MillionVerifier, which is in the EU. Onward to providers outside the EU/EEA: the safeguards MillionVerifier's privacy policy names, such as an adequacy decision, the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework |
The location and transfer mechanism are as each provider states them in its own data processing agreement and documentation, read on 6 October 2026. Where a provider does not say where it processes the data, the table names the provider's company and country, and the transfer mechanism covers processing outside the EU/EEA.
Changes
We give customers 30 days' notice before we engage a new sub-processor or replace one, by e-mail to the organisation's owners and on this page. The customer can object under clause 10 of the data processing agreement.
Not on the list
LinkedIn is not a sub-processor, and nor are Google and Microsoft as the providers of the customer's own mailboxes. Campaigns are sent from the customer's own accounts with them, under the customer's own agreements with them. Unipile connects the accounts, and because Gmail and Outlook are connected through Unipile's own apps, Google's and Microsoft's consent screens name Unipile. Google is on the list only as the host of Navigent's own mailbox, info@navigent.io.
Language and contact
The list exists in Danish and English. If the versions differ, the Danish version prevails. Questions about the list can be sent to info@navigent.io.
Navigent.io ApS · CVR 46285395 · Nørre Voldgade 70, 4., 1358 København K, Denmark · info@navigent.io