Sub-processors
Last updated: November 2026
Top5 (operated by LEFTFIELD SOLUTIONS FZE, registered in UAE) relies on the following third-party processors to deliver the service. Each sub-processor is bound by their own data processing agreement and security commitments.
We will give 30 days' prior notice via email or in-product before adding a new sub-processor that has access to customer or candidate data. To receive these notices, ensure your account email is current.
| Sub-processor | Purpose | Data accessed | Region |
|---|---|---|---|
| Supabase | Database (Postgres + pgvector) and file storage (CV blobs) | All customer + candidate data | US (Virginia) |
| Clerk | User authentication and session management | Email, name, OAuth identifiers | US |
| OpenAI | Third-party AI model provider — vector embeddings for CV semantic search | CV text — sent for embedding only, no training (per OpenAI API terms) | US |
| Anthropic | Third-party AI model provider — Topgrading assessment of CVs against a role | CV text + job description — sent for assessment only, no training (per Anthropic API terms) | US |
| Stripe | Subscription billing and tax (Stripe Tax) | Billing data: account email, payment method (held by Stripe, never by us) | US / Ireland |
| Resend | Transactional email (welcome, receipts, dunning) | Email address, name, transactional content | US |
| Sentry | Error monitoring (with PII scrubbing via beforeSend) | Stack traces and breadcrumbs — PII fields actively scrubbed | EU |
| PostHog | Product analytics — cookieless mode, identified-only profiles | Anonymous usage events and opaque user identifiers | EU |
| Render | Application hosting (Next.js, Docker) | All processed data in transit through the application | US (Virginia) |
| Cloudflare | DNS, edge caching, DDoS protection, Turnstile (bot defence) | Public traffic metadata (IP, headers, request paths) | Global edge network |
| Zoho Mail | Business email (support@, privacy@, legal@, dpo@, etc.) | Business email contents | US |
| Google (Gmail) | Mail forwarding + reply-from-alias for the business mailboxes | Business email contents | US |
Data transfer mechanisms
Where sub-processors are located outside the EU/EEA, transfers rely on the European Commission's standard contractual clauses (SCCs) annexed to the relevant sub-processor agreement, with supplementary technical and contractual measures where appropriate post-Schrems II.
Contact
Questions about a sub-processor or notice of objection: legal@top5cv.com
Privacy rights: privacy@top5cv.com
Data Protection contact: dpo@top5cv.com