Subprocessors
Every provider that may process customer personal data, what for, and where. Versioned, with notice of changes.
- Applies to
- Customers
- Last updated
- 1 September 2026
- Questions
- legal@oakhive.ai
Every third party that may process personal data on OakHive’s behalf, what they do, where they do it, and how long they keep it. This is the list referred to in the Data Processing Agreement, and it is the authoritative version.
Current version: 2026-09-01.1. Every entry here was established from the service’s own code — the endpoints it calls and the conditions under which it calls them — rather than from a vendor’s marketing page. Where a fact could only come from the provider, it says so instead of asserting it.
1What this list commits us to
A product that reads a company’s conversations should be able to say exactly who else touches them. Three commitments follow from publishing this list, and they are contractual rather than aspirational — clause 7 of the DPA makes each of them enforceable:
- It is versioned. Every change moves the version number, so you can tell at a glance whether the list you reviewed is the list in force.
- You are told before a change takes effect. At least 30 days’ notice, by email to your registered administrators, before a new provider begins processing.
- You can object. On reasonable data protection grounds, within the same window. If we cannot find an alternative within 30 days you may terminate the affected part of your subscription without penalty and get back the prepaid remainder.
2Providers that process interview data
| Provider | Purpose | Location | When it applies |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, database (Cosmos DB), search index, the large language model that writes the interview artefacts (Azure OpenAI), speech-to-text and text-to-speech, secret storage and application telemetry. | European Union — Azure West Europe region (Netherlands) | All interviews. |
| ElevenLabs | Speech recognition, conversational turn-taking and the interviewer’s synthetic voice in browser interviews. | United States | All interviews. |
| Anam | Generates the animated face of the interviewer where a video interviewer is used. | [ TO BE COMPLETED: Anam processing location ] | Interviews that use a video interviewer. |
Note what the fourth column does. Not every provider is involved in every interview: an interview without a video interviewer never touches the avatar provider at all. A list that presented all three as always-on would overstate the exposure.
3The detail, provider by provider
Microsoft Azure
| Contracting entity | Microsoft Ireland Operations Limited |
|---|---|
| Processing location | European Union — Azure West Europe region (Netherlands) |
| What they do | Cloud hosting, database (Cosmos DB), search index, the large language model that writes the interview artefacts (Azure OpenAI), speech-to-text and text-to-speech, secret storage and application telemetry. |
| What they can access | All customer data processed by the service, including interview transcripts, generated summaries, participant names and work email addresses, and audit records. |
| When they are involved | All interviews. |
| How long they hold it | For as long as OakHive stores the interview. Azure OpenAI does not use customer inputs to train its models. |
| Transfer mechanism | Not applicable — processing takes place within the EEA. |
ElevenLabs
| Contracting entity | ElevenLabs, Inc. |
|---|---|
| Processing location | United States |
| What they do | Speech recognition, conversational turn-taking and the interviewer’s synthetic voice in browser interviews. |
| What they can access | Audio of the participant’s speech and the resulting text, in real time during the session. |
| When they are involved | All interviews. |
| How long they hold it | One day. Zero-retention mode is not currently enabled on the agents, so this is a retention setting rather than an absence of retention. |
| Transfer mechanism | EU Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved. |
A customer requiring true zero retention should raise it before signature — it is a configuration change on the ElevenLabs account, not a change of wording here.
Anam
| Contracting entity | [ TO BE COMPLETED: Anam contracting entity ] |
|---|---|
| Processing location | [ TO BE COMPLETED: Anam processing location ] |
| What they do | Generates the animated face of the interviewer where a video interviewer is used. |
| What they can access | The interviewer’s speech audio and session metadata. No video or audio of the participant is sent: the participant’s camera is never requested. |
| When they are involved | Interviews that use a video interviewer. |
| How long they hold it | Up to 30 days, per the provider’s published retention policy. |
| Transfer mechanism | [ TO BE COMPLETED: Anam transfer mechanism ] |
This provider’s own subprocessor list and data residency have not been published to us. The video interviewer stays restricted to internal test accounts until that is resolved, and this row does not apply to any customer interview today.
4Providers that support the website
These providers support the public website and the handling of enquiries. None of them receives interview data.
| Provider | Purpose | Location | Retention |
|---|---|---|---|
| Cloudflare | Serves and protects the oakhive.ai website and runs the function that receives demo enquiries. | Global edge network, with processing in the region nearest the visitor | Transient. Request logs are short-lived and are not used to build visitor profiles. |
| Email provider | Receives and stores demo enquiries submitted through the website. | [ TO BE COMPLETED: email provider processing location ] | In line with the retention period stated in the Privacy Policy. |
5How changes are notified, and how to object
Notice goes to the administrator contacts registered in your tenant, and this page is updated at the same time. To object, write to privacy@oakhive.ai within 30 days of the notice, saying which provider and on what data protection grounds.
An objection is not a formality on our side. We will look for an alternative provider or a configuration that meets the concern, and we will tell you in writing what we found. If nothing works within 30 days, clause 7.3 of the DPA gives you a clean exit with a pro-rata refund.
Where a change is forced on us at short notice — a provider ceasing to operate, or a security issue that requires an immediate move — we will make the change and notify you as soon as we can, and the objection right runs from the notice instead of before the change.
6Version history
| Version | Date | What changed |
|---|---|---|
| 2026-09-01.1 | 1 September 2026 | First published list. Records the three service providers and the two website providers in use at the time of publication. |
Earlier arrangements are not shown because there was no published list to change: this is the first version, and it is dated accordingly rather than backdated to look longer-lived than it is.