Sub-processors

Last updated: February 3, 2026

Ducker uses the vendors below to run the Platform. Each one is bound by a written agreement that limits it to processing personal data on our instructions, with security obligations no less protective than those in our Data Processing Addendum.

This page is the notice mechanism required by section 7 of the DPA. We update it at least 30 days before a new sub-processor starts processing customer personal data. To be notified of changes by email, write to privacy@ducker.ai and ask to be added to the sub-processor notification list.

Infrastructure

Sub-processorPurposeEntity and locationData processing location
Amazon Web ServicesApplication hosting, databases, object storage, content delivery, message queuesAmazon Web Services EMEA SARL, LuxembourgGermany (eu-central-1); United States (us-east-1) for edge certificates and content delivery
CloudflareAuthoritative DNSCloudflare, Inc., United StatesGlobal anycast network. DNS records only — traffic is not proxied through Cloudflare and no customer content passes through it

Artificial Intelligence

Sub-processorPurposeEntity and locationData processing location
Amazon Bedrock (Amazon Web Services)Model inference for the coding agent, the reviewer agent, and task authoringAmazon Web Services EMEA SARL, LuxembourgEuropean Union
OpenAIModel inference for the coding agent, the reviewer agent, and task authoringOpenAI, L.L.C., United StatesUnited States

Under our agreements with both providers, content sent for inference is used only to return a response, is not used to train or fine-tune their models, and is not retained beyond what is needed to deliver the service and meet their own abuse-monitoring obligations.

Billing

Sub-processorPurposeEntity and locationData processing location
Lemon SqueezyMerchant of record — payment processing, invoicing, sales tax and VAT collectionLemon Squeezy, LLC, United StatesUnited States

Lemon Squeezy is the seller of record for your subscription. For payment and tax data it acts as an independent controller under its own privacy policy, not as our processor. We never receive or store full card numbers, card security codes, or bank account details.

Communications

Sub-processorPurposeEntity and locationData processing location
ResendTransactional email — candidate invitations, account and security notices, report deliveryResend, Inc., United StatesUnited States

Analytics

Sub-processorPurposeEntity and locationData processing location
MixpanelProduct analyticsMixpanel, Inc., United StatesEuropean Union — events are relayed through our own domain to Mixpanel's EU ingestion endpoint
Google Analytics 4Website and marketing analyticsGoogle Ireland Limited, IrelandEuropean Union and United States

Analytics covers the marketing site and the employer console. It is not used inside the candidate assessment workspace.

Authentication Providers

Where a user chooses to sign in with a third-party identity provider, that provider processes the sign-in and returns basic profile information to us. These are not sub-processors of ours — they act as independent controllers, and they are engaged only at the user's election.

ProviderEntity
GoogleGoogle Ireland Limited, Ireland
GitHubGitHub, Inc., United States
AppleApple Distribution International Ltd., Ireland
Meta (Facebook)Meta Platforms Ireland Limited, Ireland

Affiliates

Ducker Ltd. (Israel) is the contracting entity and processes customer personal data directly. We have no affiliates that process it.

International Transfers

Transfers to sub-processors outside the EEA and the UK rely on the European Commission's Standard Contractual Clauses, on the UK International Data Transfer Addendum where relevant, or on the recipient's EU-US Data Privacy Framework certification. Transfers to Ducker in Israel rely on the European Commission's adequacy decision for Israel.

Questions

Ducker Ltd. privacy@ducker.ai