Phaedra Solutions · Rubrily
Subprocessors
Effective: 11 July 2026Last updated: 11 July 2026Version: 1.0
The complete, maintained list of third parties that process customer and candidate data on our behalf — what each one does, where it runs, which data it touches, and the transfer mechanism that covers it. Referenced by the Privacy Policy and incorporated into the DPA as Annex III.
1. Current subprocessors
Phaedra Solutions uses these third-party providers (“subprocessors”) to deliver Rubrily. Each is bound by a contract imposing data-protection obligations no less protective than our DPA, and we remain fully liable to customers for their performance.
| Subprocessor | Function | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Website and application hosting, CDN, serverless compute | All data transiting the site and Service (form submissions, account data, server logs) | United States (global edge network) | EU Standard Contractual Clauses (2021/914) |
| Rubrily application infrastructure — [CONFIRM: database / storage / compute provider(s) behind app.rubrily.com, with region(s)] | Application database, file storage (CVs, recordings), compute | Customer account data; candidate application data, CVs, assessment responses, recordings, transcripts, scores | [CONFIRM: region(s)] | EU Standard Contractual Clauses (2021/914) |
| Resend, Inc. | Transactional email delivery (invites, notifications, form receipts) | Names, email addresses, message content | United States [CONFIRM: Resend data region] | EU Standard Contractual Clauses (2021/914) |
| AI model provider(s) — [CONFIRM: name the provider(s) used for CV evaluation, interview conduct and scoring] | Large-language-model inference for CV evaluation, interview questioning and rubric scoring | CV text, interview transcripts and responses, rubric criteria (pseudonymised where feasible) | [CONFIRM: provider region / zero-retention configuration] | EU Standard Contractual Clauses (2021/914) |
| PostHog, Inc. (planned) | Product analytics on the marketing site (consent-gated) | Usage events, device and page data, first-touch campaign attribution | United States (US cloud) | EU Standard Contractual Clauses (2021/914) |
Some features let your organization connect its own services — for example connecting your own Gmail mailbox so candidate emails send from your address. Data handled by a service you connect is governed by your agreement with that provider, not by our subprocessor list.
2. Change notifications
Before adding or replacing a subprocessor we give customers at least 30days’ notice by email, with a right to object on reasonable data-protection grounds — the process is in DPA §5. To subscribe to these notifications, email legal@rubrily.com with the subject “Subscribe: subprocessor updates” (default — confirm whether a list tool replaces this mailbox flow). This page is the canonical list; the “last updated” date above changes with every revision.
Contact
Phaedra Solutions ([CONFIRM: exact registered legal form, e.g. “Phaedra Solutions (Private) Limited”]), Lahore, Pakistan · [CONFIRM: full registered company address]
Privacy: privacy@rubrily.com · Legal: legal@rubrily.com · General: contact@rubrily.com