Sub-processors
Last updated: 13 October 2026
A sub-processor is a third party that Floats engages to process personal data on your behalf in the course of providing the Services. This page is the current list of Floats' sub-processors, maintained under clause 6 of our Data Processing Agreement (DPA). It records, for each sub-processor, the purpose of the processing, the categories of personal data involved, the processing location, and the legal basis relied on for any transfer of personal data outside the United Kingdom.
Floats is operated by SOLA System Pty Ltd (ABN 55 689 449 830), trading as Floats. Our primary infrastructure is in Australia and our personnel access customer personal data from Australia.
Notice of changes. Under the general authorisation in our DPA, we will give customers at least 30 days' notice of any intended addition to, or replacement of, a sub-processor on this list, so that you have an opportunity to object before the change takes effect.
Floats personnel
Floats personnel
- Purpose
- Engineering, support and operation of the Services
- Personal data
- All customer personal data, on a need-to-access basis
- Location
- Australia
- Transfer basis
- EU SCCs + UK Addendum (Clause 12.2, Annex 6)
Infrastructure and core processing
Amazon Web Services, Inc. (EC2, S3)
- Purpose
- Application server, PostgreSQL and Redis; object storage for CVs, photos, portfolio files and attachments; backups
- Personal data
- Candidate CVs and all contained personal data, photos, documents; database records including contacts, candidates and user details
- Location
- ap-southeast-2 (Sydney, Australia)
- Transfer basis
- Onward transfer within Australia under Clause 12.2; AWS UK GDPR Addendum (SCCs + UK Addendum); DPF with UK Extension
Vercel Inc.
- Purpose
- Hosting and serverless execution of the web client, including CV processing and PDF generation
- Personal data
- Candidate data in transit through server-side functions
- Location
- syd1 (Sydney, Australia)
- Transfer basis
- Vercel DPA (SCCs + UK Addendum); DPF with UK Extension
AI and data enrichment
OpenAI OpCo, LLC
- Purpose
- CV parsing and structured extraction; candidate profile and summary generation
- Personal data
- Full CV content — name, contact details, employment history, education
- Location
- United States
- Transfer basis
- OpenAI DPA incorporating SCCs + UK Addendum. Not DPF-certified — covered by transfer risk assessment §6.2
Langfuse (ClickHouse)
- Purpose
- LLM observability, tracing and prompt management
- Personal data
- LLM prompts and completions, which may contain candidate data
- Location
- EU (Ireland; disaster recovery in Frankfurt)
- Transfer basis
- EEA approval regulations; ClickHouse DPA (SCCs + UK Addendum) for any access from outside the EEA
Communications
Mailgun Technologies, Inc. (Sinch)
- Purpose
- Outbound transactional email. Float and submission email is sent through your connected Google or Outlook account
- Personal data
- User email addresses; contact names and email addresses
- Location
- United States
- Transfer basis
- DPF with UK Extension; Sinch DPA (SCCs + UK Addendum)
Pusher — MessageBird UK Ltd
- Purpose
- Real-time WebSocket notifications
- Personal data
- User IDs
- Location
- ap4 (Sydney, Australia)
- Transfer basis
- No restricted transfer. The recipient is in the UK and directly subject to UK GDPR
Platform and operational
Functional Software, Inc. (Sentry)
- Purpose
- Error monitoring and tracing (API and client)
- Personal data
- None intended
- Location
- United States
- Transfer basis
- DPF with UK Extension; Sentry DPA (SCCs Module 2 + UK terms)
Cloudinary Ltd (Israel)
- Purpose
- Image storage and transformation
- Personal data
- Candidate and company logo images
- Location
- United States
- Transfer basis
- DPF with UK Extension; Cloudinary DPA
Unified.to — Unified API Inc.
- Purpose
- ATS integration middleware
- Personal data
- Candidate and contact records synced from your ATS, if connected. Not stored at rest
- Location
- United States
- Transfer basis
- UK approval regulations for Canada (commercial organisations subject to PIPEDA)
Optional sub-processors
Depending on selected plan
Perplexity AI, Inc.
- Purpose
- Web research for company and role context. Used only when SOLA is active in the account
- Personal data
- Search queries as entered by the user
- Location
- United States
- Transfer basis
- DPF with UK Extension; SCCs + UK Addendum fallback
Prospeo — Defastra Tech Inc.
- Purpose
- Contact data enrichment, including business email addresses and phone numbers
- Personal data
- Contact names, companies and LinkedIn profile URLs submitted for enrichment; business contact details returned
- Location
- Canada
- Transfer basis
- UK approval regulations for Canada (commercial organisations subject to PIPEDA); Prospeo DPA (SCCs + UK Addendum) fallback
Excluded from this list
- Customer-directed integrations. Microsoft Graph / Outlook, Google / Gmail and LinkedIn are connected by you, using your own credentials, to systems you already control. They are disclosed here for transparency but are not our sub-processors.
- Controller-side vendors. Stripe, LLC (billing) and MailerLite (marketing to Floats customers) process data for which we act as controller under clause 2.4 of the DPA. They do not process candidate data.
- No customer personal data received. CSV import uses CSVbox in Private Mode: the import widget runs in your browser and imported records are sent directly to our servers, never to CSVbox.
SOLA System Pty Ltd (ABN 55 689 449 830) trading as Floats.