Sub-processor List
This page lists the third-party Sub-processors engaged by Dunross AI s.r.o. ("Dunross AI") to provide the Klara AI pre-screening platform (the "Service"). This list is incorporated by reference into our Data Processing Agreement at https://dunross.ai/dpa.html.
We are committed to transparency about who we work with to deliver the Service. We carefully select Sub-processors based on their data protection practices, security measures, and compliance posture, and we maintain written agreements with each Sub-processor that impose data protection obligations consistent with our own commitments to Customers.
1. Current Sub-processors
The following Sub-processors are engaged by Dunross AI to provide the Service:
| Sub-processor | Role | Location | Personal Data processed | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting and infrastructure | Germany (EU) | All Personal Data | EU/EEA — no transfer mechanism required |
| Supabase, Inc. | Managed database services | EU region | All Personal Data | EU/EEA — no transfer mechanism required |
| OpenAI, OpCo LLC | AI inference for natural language processing | United States | Interview transcripts and screening criteria | Standard Contractual Clauses |
| Cartesia, Inc. | Text-to-speech voice generation | United States | Klara-generated text only (no Candidate data) | Standard Contractual Clauses |
| LiveKit, Inc. | Real-time voice infrastructure | United States and EU | Voice streams during active interview sessions | Standard Contractual Clauses |
| Soniox, Inc. | Speech-to-text transcription | United States | Voice streams during active interview sessions | Standard Contractual Clauses |
| Resend, Inc. | Email delivery | United States | Email addresses and email content | Standard Contractual Clauses |
| Cloudflare, Inc. | Content delivery network and edge security | Global edge network | IP addresses, technical data | Standard Contractual Clauses |
2. How we manage Sub-processors
2.1 Selection
Each Sub-processor is evaluated for:
- Data protection and privacy practices
- Security measures appropriate to the data they process
- Compliance with GDPR and applicable data protection laws
- Reliability and operational maturity
- Geographic location and applicable transfer mechanisms
2.2 Written agreements
We maintain written data processing agreements with every Sub-processor that impose data protection obligations substantially equivalent to those we have with our Customers, including:
- Processing data only on documented instructions
- Implementing appropriate technical and organizational security measures
- Assisting with Data Subject Requests
- Notifying us of Personal Data Breaches without undue delay
- Returning or deleting data on termination
2.3 International transfers
For Sub-processors located outside the European Union or European Economic Area, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional safeguards where appropriate. Specifically, we use the SCCs approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
2.4 Ongoing oversight
We periodically review our Sub-processors to confirm that they continue to meet our requirements. We may add, remove, or replace Sub-processors as the Service evolves.
3. Notification of changes
We are committed to providing transparency about changes to our Sub-processor list.
3.1 Advance notice
We will provide at least thirty (30) days' advance notice of any intended addition or replacement of Sub-processors, in accordance with Section 7.4 of our Data Processing Agreement.
3.2 How to receive notifications
To receive email notifications when this Sub-processor list changes, subscribe using the form below. We use double opt-in, so you will receive a confirmation email before being added to the notification list. You can unsubscribe at any time using the link included in every notification email.
3.3 Customer objection rights
Customers may object to a new Sub-processor on reasonable data protection grounds within fifteen (15) days of notification. If we cannot reach a resolution with the Customer, the Customer may terminate the relevant Service component without penalty, as set out in our Data Processing Agreement.
4. Historical changes
This section tracks material changes to our Sub-processor list. Each entry includes the effective date, what changed, and a brief explanation.
No changes to date. This is the initial Sub-processor list as of June 21, 2026.
5. Contact
For questions about our Sub-processors or to exercise rights related to their processing of your Personal Data:
- Email: [email protected]
- Postal: Dunross AI s.r.o., Pod Chytárnou 46, Zaječice - Pyšely, 251 67, Czech Republic
For our full Privacy Policy: https://dunross.ai/privacy.html
For our full Data Processing Agreement: https://dunross.ai/dpa.html