See dokument on ingliskeelne ja siduv on ingliskeelne versioon. Küsimuste korral kirjuta hello@staffholm.com.
Sub-processors
Staffholm and Rolefit are brands of Sirin OÜ, a company registered in Estonia (registry code 16315993). Staffholm is the service employers use, and Rolefit is the name candidates see when they apply. Wherever this document says “Staffholm”, “Rolefit”, “we” or “us”, it means Sirin OÜ.
We give account owners 30 days' notice by email before adding or replacing a sub-processor, and they can object. See §5 of the Data Processing Agreement.
Who processes candidate data
| Sub-processor | What it does | Data it touches | Where | Transfer basis |
|---|---|---|---|---|
| Supabase (Supabase Inc., US) | Database, file storage, authentication | Everything: CVs, answers, contact details, decisions | EU | Standard Contractual Clauses, under Supabase's data processing addendum |
| Cloudflare (Cloudflare Inc., US) | Serves the application, edge compute, DDoS protection. Sends the emails candidates receive from rolefit.eu, forwards mail sent to rolefit.eu and staffholm.com addresses, and receives the CVs employers forward to their company's address | Data in transit; application logic runs at the edge. For email, candidate name, email address, message content and attached CVs | Global edge; data at rest stays with Supabase | Standard Contractual Clauses, under Cloudflare's data processing addendum |
| Anthropic (Anthropic Ireland, Limited, with processing by Anthropic, PBC, US) | The model that reads the CV, writes the questions and scores the fit | CV text and answers, sent for processing | US | Standard Contractual Clauses, under Anthropic's data processing addendum, which is part of its commercial terms |
| Resend (Resend Inc., US) | Sends the emails employers receive from Staffholm (sign-up, password, invitations), and is the backup route for candidate emails | Name, email address, message content | EU sending region (Ireland) | Standard Contractual Clauses, under Resend's data processing addendum |
| Zoho (Zoho Corporation B.V., Netherlands) | Our own mailbox. Mail sent to our privacy, info and security addresses lands here | Only what somebody writes to us, for example a candidate's request | EU | Not a transfer |
Who processes customer data only
| Sub-processor | What it does | Data it touches | Where |
|---|---|---|---|
| Stripe (Stripe's European company, Ireland) | Subscriptions and payment | Billing contact, company name, VAT number, payment method | EU/US, SCCs |
Stripe never touches candidate data. Card details never reach Staffholm at all, because payment happens on Stripe's own pages.
About Anthropic
"You send CVs to an AI company" is the sentence a buyer's legal team asks about, so here is what stands behind it.
- No training. Anthropic's commercial terms do not allow it to train models on customer content.
- Retention. Anthropic deletes API inputs and outputs within 30 days. Content flagged for breaking its usage rules can be kept for up to 2 years, and safety scores for up to 7 years. We do not have a zero data retention arrangement with Anthropic today.
- Contract. Anthropic's data processing addendum is part of its commercial terms and uses the EU Standard Contractual Clauses.
Not sub-processors
- Zone: domain names. No candidate data.
- GitHub: source code. No customer or candidate data.
Review
Reviewed whenever a provider is added or changed, and at least annually. Last reviewed: 1 November 2026.