Subprocessors

How to read this register

This page distinguishes documented infrastructure from optional integrations. It is not a statement that every named provider processes every customer’s data. The customer’s processing schedule identifies the applicable contracting entities, enabled routes, locations and transfer safeguards. Provider documentation alone does not prove that DAWN has executed a particular contract.

The infrastructure below is supported by DAWN deployment records reviewed for this publication. Application hosting was also checked against the current production deployment. Feature adapters in source code are not evidence of an active production appointment.

Documented infrastructure

Vercel: website and application hosting and content delivery. Receives technical requests and, for application requests, data needed by the relevant service. Delivery and operational processing can be global.

Amazon Web Services: backend compute and object storage, including uploaded files and interview media where enabled. Deployment records identify Stockholm infrastructure and private file access. This does not make a promise about every service or all support access.

Supabase: managed PostgreSQL for account, organisation, workforce and application records. Deployment records identify Frankfurt database hosting. The configured database region does not exclude international operational or support processing.

Resend: transactional email delivery, including recipient addresses, verification messages and interview invitations. Deployment records identify an Ireland sending region and disabled open and click tracking. This is not an EU-only processing guarantee.

LiveKit Cloud: realtime interview transport and agent infrastructure where enabled. Deployment records identify European agent compute and a separate US observability region. Recording, transcription and observability are distinct settings; enabling one does not establish the state of the others.

Configurable AI, speech and telephone services

The application includes routes or adapters for AI and speech services such as OpenAI, Anthropic, Google, Groq and Deepgram, and telephone carriers including Twilio, Vonage, 46elks and Sinch. Support in code is not confirmation that a route is enabled, that a supplier agreement is in place or that it receives your data. The selected route can receive request text, relevant context, audio, a telephone number or call instructions, according to the capability.

Identity connections, including Criipto and selected social sign-in services, depend on the login method used. Customer-connected services may act under their own agreement rather than as DAWN-appointed subprocessors. Before using a feature with personal data, the applicable recipients and their roles must be identified in the service configuration and processing schedule.

Changes and requests

Contact hello@dawnhcm.com for the provider schedule relevant to your organisation, transfer information or an objection to a proposed change. The DPA requires written authorisation and, for general authorisation, advance notice with a meaningful opportunity to object. This public register is not a substitute for that notice or for the customer’s authorisation.