Subprocessors and Service Providers

1. Responsibility and scope

HireValid is operated by Recordskeeper Inc, a Delaware C-Corp. Our business mailing address is 2261 Market Street STE 86483, San Francisco, CA 94114. Service providers support defined operational functions. Whether a provider acts as a subprocessor, independent controller or supplier depends on the data and service. This page distinguishes website services from the employer application; it is not evidence that every supported integration is enabled.

2. Website email

Postmark, a service of ActiveCampaign, is the configured provider for contact and subscriber email delivery. Messages contain submitted details necessary to route an inquiry or record a subscription, plus delivery metadata. Designated administrators receive these messages in business mailboxes. Email processing may take place in the United States; contact us for the provider terms and safeguards applicable to your request.

3. Country lookup and optional website services

When configured, ipstack receives the visitor’s public IP address to return a country code for regional pricing. The API key stays on our server. This is a functional pricing lookup, separate from optional advertising and analytics. Google Analytics measures website use when configured and analytics consent is given. The website also supports PostHog, advertising integrations, Cloudflare Turnstile for bot checks and Upstash for shared rate limiting. Their support in code is not a statement that they currently process your data. Optional tracking follows cookie preferences; necessary security processing, if enabled, must be proportionate and disclosed.

4. Employer deployment register

Customers should request the register applicable to their employer account before supplying candidate information. It must identify each authorized processor, function, data categories, processing location and relevant transfer safeguards, including hosting, storage and account communications. We do not infer a hosting provider or region from the technology used to build this website.

5. Selection, changes and objections

Providers must be assessed for their role and bound by appropriate confidentiality, security and processing terms. For employer-directed processing, the DPA governs authorization, advance notice and objections. Send a reasoned objection to [email protected] identifying the provider and risk so we can assess alternatives or mitigation.

6. Information requests

For the current list relevant to your service, email [email protected] with your organization and the service in question. We will distinguish confirmed operational providers from optional integrations and explain relevant safeguards without exposing credentials or security-sensitive configuration.