Legal

Sub-processors

Last updated: 3 June 2026

Draft — pending legal review

This document is a structural scaffold. The wording must be reviewed and finalised by legal counsel before launch.

Plumb engages the following sub-processors to deliver the service. We give notice before adding a new sub-processor. [REVIEW: confirm regions and contractual safeguards with counsel.]

Current sub-processors

Supabase — database, authentication, and file storage. Region: eu-west-2 (London).
Netlify — application hosting and CDN. Region: EU edge.
Postmark — transactional email delivery. Region: EU.
Cloudflare Turnstile — bot protection on public sign-up and candidate sign-in forms. Processes the challenge interaction and requesting IP only; no candidate or organisation personal data.
Anthropic — AI assistance (drafting and summarisation; never scoring or ranking). [REVIEW: confirm region / data-handling terms.]

Email hosting

Inbound mailboxes for the hireplumb.org domain are hosted by SiteGround. [REVIEW: confirm whether this is in scope as a sub-processor for customer personal data.]

Changes

[REVIEW: notice mechanism and objection window for new or replaced sub-processors.]