Legal
The third parties that process customer data on our behalf, what each one does, and where it runs. We give thirty days notice before this list changes.
Last updated
19 September 2026
Effective
1 October 2026
Version
1.0
01
Current list
Northpeak Cloud
Hosting and primary data storage
Driftgate
Content delivery, DNS and DDoS protection
Emberpost
Transactional email delivery
Sundial
SMS notifications for interview reminders
Tallyrock
Subscription billing and payment processing
Havenline
Customer support ticketing
Pulsewell
Application monitoring and error reporting
Quarrylake
Aggregated product analytics warehouse
02
How we choose them
Every sub-processor is reviewed before it touches customer data: what it needs, where it runs, how it is secured, and what happens if it fails. We prefer EU-hosted providers, and we keep the list as short as the product allows.
Each one is bound by a written contract with terms no less protective than our own Data Processing Agreement, including the Standard Contractual Clauses where data leaves the EEA.
03
Notice of changes
We give thirty days notice before adding or replacing a sub-processor. To receive that notice by email, subscribe from your workspace settings or write to privacy@yardstick.example.
A customer who reasonably objects on data protection grounds within the notice window may terminate the affected part of the service without penalty, as set out in the Data Processing Agreement.
04
EU-only processing
Enterprise customers can request a configuration that restricts processing to sub-processors operating inside the European Union. It removes SMS notifications and changes how support tickets are handled.
Ask us about this before you sign rather than after, because moving an existing workspace onto it takes planning.