Sub-Processor List
Last updated: April 2026
This list is maintained in accordance with Welldin's Privacy Policy and applicable data protection law. Customers who have entered into a Data Processing Agreement with Welldin will be notified of material changes to this list prior to those changes taking effect.
What is a sub-processor?
A sub-processor is a third-party company that Welldin engages to process personal data on its behalf in the course of delivering the Platform. Welldin remains responsible for ensuring that all sub-processors provide sufficient guarantees of data protection and are bound by appropriate contractual obligations.
List of Sub-Processors
| Sub-Processor | Country | Purpose | Data Processed | Transfer Mechanism |
|---|---|---|---|---|
| OpenAI, Inc. | United States | Live AI interview agent (Realtime API); voice transcription (Whisper); post-interview analysis and scoring (gpt-4o-mini) | Live candidate voice and audio; audio recordings; text transcripts; job descriptions; evaluation prompts | EU-US DPF / SCCs |
| LiveKit, Inc. | United States | Real-time video and audio communication and interview recording | Candidate video and audio streams; interview session metadata | SCCs |
| ElevenLabs, Inc. | United States | Text-to-speech voice generation for interview delivery | Interview text content | SCCs |
| Langfuse GmbH | Germany / EU | LLM observability, tracing, and prompt management | Interview transcripts; AI prompts and outputs; candidate names; scores; job metadata | Intra-EEA |
| DigitalOcean, LLC | United States | Cloud storage for interview recordings and uploaded files | Interview recordings (MP4/OGG); uploaded documents | SCCs |
| Brevo SAS (Sendinblue) | France / EU | Transactional email delivery (invitations, verifications, notifications) | Candidate and Customer email addresses; invitation and notification content | Intra-EEA |
Notes
OpenAI
OpenAI is used for three distinct purposes: (1) the live AI interview agent via the Realtime API, through which candidates interact with an OpenAI model in real time during the assessment; (2) voice transcription of recorded responses via Whisper; and (3) post-interview analysis and scoring via gpt-4o-mini. Candidates are informed prior to commencing an assessment that they will be interacting with and evaluated by an AI system. Welldin uses OpenAI's API tier, which does not use inputs or outputs for model training by default.
LiveKit
LiveKit handles real-time WebRTC video and audio streams during interviews and triggers recording egress to DigitalOcean Spaces. LiveKit processes candidate video and audio in transit but does not persistently store personal data beyond session metadata.
ElevenLabs
Used to generate spoken audio from interview text content for delivery to candidates during the assessment. Only interview text content is transmitted; no candidate personal data beyond what is contained in that text is passed to ElevenLabs.
Langfuse
Used for LLM observability, tracing, and prompt management via cloud.langfuse.com. Langfuse receives and stores interview transcripts, AI prompts and outputs, candidate names, scores, and job metadata. As Langfuse GmbH is headquartered in Germany, processing within the EEA does not require a transfer mechanism. A Data Processing Agreement with Langfuse should be in place before any candidate personal data is processed through this service.
DigitalOcean
Candidate audio and video recordings (.mp4 and .ogg files) are stored in DigitalOcean Spaces. Text transcripts and analysis results are stored in the application database. Personal data is retained for no longer than necessary for the purposes described in Welldin's Privacy Policy and is deleted upon receipt of a valid deletion request.
Brevo
Used for transactional email delivery via smtp-relay.brevo.com. Brevo SAS is headquartered in Paris, France, and is directly subject to GDPR. Where Brevo transfers data outside the EEA in the course of delivery, it relies on SCCs as the applicable transfer mechanism.
Transfer mechanisms
Where sub-processors are located in the United States or another country outside the European Economic Area or the United Kingdom, Welldin relies on Standard Contractual Clauses (SCCs) adopted by the European Commission, or the EU-US Data Privacy Framework (DPF) where the sub-processor is certified.
Changes to this list
Welldin will update this page prior to engaging any new sub-processor that processes Candidate personal data, or upon any material change to the role or data processed by an existing sub-processor. Customers who have signed a Data Processing Agreement with Welldin will receive advance notice of such changes by email.
Questions
For questions about this list or Welldin's sub-processor arrangements, contact info@welldin.com.
© 2026 Welldin, Inc. All rights reserved.