SourcingNavSubprocessors
Subprocessors and third parties
Read from the code on 16 October 2026
This is every outside service SourcingNav's code calls, what it is for, and what it receives. It is built from the code, not from a contract register: a guard test reads every address and every provider key in the server code and fails the build when a service is called that this page does not name, or when this page names one the code does not call. Many lanes are switched on per deployment by setting a key; those rows say only when and name the key.
Two lines that hold for every row: the voluntary self-identification answers an applicant gives are kept only in SourcingNav's own database (Turso, reached through Vercel's functions) and sent to none of the other services here, and no search provider is ever sent a score, a note or a decision.
Running the service
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Vercelhosting platform |
Hosts the site and the API, runs the scheduled jobs, and builds each deploy. The API runs in Vercel's pdx1 region (Portland, Oregon, United States). Most pages, the signed-in desk included, also load Vercel Speed Insights, which reports page timings. |
Everything the service handles passes through its functions. Speed Insights receives the page address and load timings; it is left off every page whose path carries a token, and still loads on the pages that carry a token in the query string (the sign-in link among them). |
Always |
| Tursothe database, at TURSO_URL |
The database (libSQL), reached over HTTPS. |
Everything SourcingNav stores: accounts, roles, people, pipelines, messages, receipts. |
Always (TURSO_URL, TURSO_AUTH_TOKEN) |
| Anthropicapi.anthropic.com |
The language models behind reading a job description, reading a profile or a résumé against a role, extracting a meeting's notes, and drafting outreach. |
The text each feature asks a model to read: the job description, the profile or résumé text of the person being read, meeting notes or transcripts, and the facts a draft is written from. |
Always: production refuses to start without SERVER_ANTHROPIC_KEY |
| Resendapi.resend.com |
Sends the service's own email: sign-in links, privacy-request confirmations, scheduling and pipeline notices, alerts to the operator, and outreach that does not go through a recruiter's own connected mailbox. Sends back delivery events. With a reply domain set, it also receives the replies candidates send to that mail, which SourcingNav reads into the tracker and forwards to the recruiter's own inbox. |
The recipient's address, the subject and the body. An operator alert carries the error text, and, when a receipt could not be queued, the receipt itself so it can be queued by hand. With a reply domain, each reply as the candidate wrote it. |
Only when RESEND_API_KEY is set (sign-in by email needs it); delivery events only when RESEND_WEBHOOK_SECRET is set; replies only when REPLY_INBOUND_DOMAIN is set |
Searching for people
These receive what a search is made of: job titles, skills, place names and company names, and, for the location lookup and the job-change watch, the address of the public profile being checked (written as a site: query). Exa can also be handed a public profile's address to return its own indexed copy of that page. None of them is sent a score, a note or a decision.
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Serpergoogle.serper.dev |
Google web and news results: the main search lane, the location lookup, the job-change watch and company news. |
Query strings. |
Only when SERPER_API_KEY is set |
| SerpApiserpapi.com |
Bing and Yandex results, as extra search lanes. |
Query strings. |
Only when SERPAPI_API_KEY is set |
| Exaapi.exa.ai |
A neural web index as a search lane, and its copy of a public profile page for the location lookup's second chance and the second look at the top of a run. |
Query strings, and up to 25 public profile addresses per call. |
Only when EXA_API_KEY is set |
| Perplexityapi.perplexity.ai |
A search lane. |
Query strings. |
Only when PERPLEXITY_API_KEY is set |
| Brave Searchapi.search.brave.com |
A search lane. |
Query strings. |
Only when BRAVE_API_KEY is set |
| Tavilyapi.tavily.com |
A search lane and company news. |
Query strings (a role, a few skills, a city). |
Only when TAVILY_API_KEY is set |
| People Data Labsapi.peopledatalabs.com |
A structured person search, and on a recruiter's click a richer public profile of one person. SourcingNav reads profile fields only from it, never an email or a phone number. |
The search: titles, skills and the United States. The click: one public profile address, or a name and an employer. |
Only when PDL_API_KEY is set |
| GitHub APIapi.github.com |
People search by language and place, and one public profile read for a GitHub login a person published. |
Query strings; a GitHub login. |
People search only when GITHUB_TOKEN is set; a single profile read runs without it |
| OpenAlexapi.openalex.org |
Research papers and their authors, as a search lane. |
Research-topic phrases, and the contact address OpenAlex asks callers to send (OPENALEX_MAILTO). |
No key needed |
Finding a contact detail
A contact lookup is one person at a time, on a recruiter's explicit click, after the opt-out list is checked, and each paid lookup is receipted. SourcingNav buys no contact lists.
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| SignalHirewww.signalhire.com |
Looks up an email address and a phone number for one person, and reports the account's credit balance. |
One public profile address or an email address the desk already holds, and a signed callback address for the answer. |
Only when SIGNALHIRE_API_KEY is set |
| Hunterapi.hunter.io |
Finds a work email address for one person. |
A first and last name, and an employer's domain or company name. |
Only when HUNTER_API_KEY is set |
| Google Public DNSdns.google |
Checks that an email address's domain receives mail before it is used. |
The domain part of the address only. |
No key needed |
Reading a person's public footprint
These run when a recruiter enriches one person, and on the authenticity check that reads an application's own links. Each receives only what the person published or handed over themselves.
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Gravatargravatar.com |
The public profile a person attached to their own email address. |
An MD5 hash of the email address. |
No key needed |
| Hacker News, DEV, Bluesky, Stack Exchangehacker-news.firebaseio.com, dev.to, public.api.bsky.app, api.stackexchange.com |
The public profile behind a handle or a user id the person published. |
That handle or user id. |
No key needed |
Other models
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Voyage AIapi.voyageai.com |
Embeddings of the desk's own captured pages and résumés so a search can read them first, and re-ranking the strongest rows of a run against the role. |
The text of those pages and résumés; the role's text and the top rows' titles and snippets. |
Only when VOYAGE_API_KEY is set; without it a local embedder runs on the server |
| OpenAIapi.openai.com |
Embeddings that nudge a run's order by how close each row reads to the role. Embeddings only: no chat model of theirs is called. |
The role's text, each row's title and snippet, and the skill words the desk liked or passed on. |
Only when SERVER_OPENAI_KEY is set |
| Groqapi.groq.com |
Speech to text for a meeting a recruiter records in Notes. |
The recorded audio, in chunks. It is forwarded and never stored by SourcingNav. |
Only when GROQ_API_KEY is set; without it notes are typed |
Mail, calendars and messaging a recruiter connects
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Googleaccounts.google.com, oauth2.googleapis.com, www.googleapis.com, gmail.googleapis.com |
Sign in with Google; a connected Google Calendar (free/busy and the events SourcingNav books); a connected Gmail that sends through the Gmail API with the send-only scope. |
The sign-in exchange; the meetings booked (title, time, attendees' addresses); the messages the recruiter sends. |
Only when GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set and the recruiter connects; the sign-in and Gmail buttons also wait for OAUTH_READY |
| Gmail by app passwordsmtp.gmail.com, imap.gmail.com |
Sends from the recruiter's own Gmail, and reads its inbox, read-only, to find replies. |
The messages the recruiter sends. The app password is the recruiter's, stored encrypted. |
No server key; only for a recruiter who connects an app password |
| Microsoftlogin.microsoftonline.com, graph.microsoft.com |
Sign in with Microsoft; a connected Outlook mailbox and calendar (send mail, read replies, book meetings). |
The sign-in exchange; the messages and meetings that go through the connected mailbox. |
Only when OUTLOOK_CLIENT_ID and OUTLOOK_CLIENT_SECRET are set and the recruiter connects |
| Slackslack.com |
A message in a channel linked to a desk becomes a task, and the answer is posted back into its thread. |
The reply text; a Slack user id to look up a display name. |
Only when SLACK_BOT_TOKEN is set; incoming messages only when SLACK_SIGNING_SECRET is set |
| Zoomzoom.us |
Reads the transcript of a cloud-recorded meeting on the connected Zoom account. |
The request for a recording; the transcript comes back from Zoom. |
Only when ZOOM_ACCOUNT_ID, ZOOM_CLIENT_ID, ZOOM_CLIENT_SECRET and ZOOM_WEBHOOK_SECRET are set |
| Twilioapi.twilio.com |
Text messages to a candidate who agreed to receive them, and their replies. |
The phone number and the message; replies come back signed. |
Only when SMS_ACCOUNT_SID and SMS_AUTH_TOKEN are set |
Billing
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| Stripeapi.stripe.com |
Checkout and the billing portal for a paid plan, and the subscription events that follow. |
The account's email address and its SourcingNav user id. Card details are entered on Stripe's own page and never reach SourcingNav. |
Only when STRIPE_SECRET_KEY is set; events only when STRIPE_WEBHOOK_SECRET is set |
Public records read for company facts and the owned index
These send no personal data: company names, ticker symbols, and subject-area search terms.
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| SEC EDGARwww.sec.gov, data.sec.gov, efts.sec.gov |
Whether a company is public, its filed revenue and headcount, and Form D for private companies. |
A company name or its SEC number, and the contact SEC asks every caller to name in its User-Agent. |
Only when SEC_EDGAR_UA is set |
| Stooqstooq.com |
Daily closing prices for a public company's stock. |
Ticker symbols. |
No key needed |
| Twelve Dataapi.twelvedata.com |
Stock prices for the market signals. |
Ticker symbols. |
Only when STOCK_API_KEY is set |
| US Bureau of Economic Analysisapps.bea.gov |
Regional price parities, for comparing pay across places. |
The table and the year asked for. |
Only when BEA_API_KEY is set |
| Public registerswww.osti.gov, ntrs.nasa.gov, api.www.sbir.gov, data.colorado.gov, data.fcc.gov |
DOE and NASA technical reports and their authors, SBIR awards, the Colorado engineer licence roster, and a test of the FCC's licence search, for the owned index. |
Subject-area search terms and page numbers. |
No key needed |
| PatentsViewsearch.patentsview.org |
Patent inventors. Built and dormant on purpose. |
An inventor's name or a topic. |
Only when PATENTSVIEW_API_KEY is set |
The receipts chain
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| AIR Blackbox receipt serverthe address in AIR_INGEST_URL |
Keeps the append-only chain of decision receipts described on the compliance page, and produces the evidence bundle, which spans every desk on SourcingNav and only SourcingNav's operator can download. |
Each receipt: the kind of decision, the criteria text, the desk it came from, a reference to the person or role, the decision's inputs and outputs, the model that produced it, and who reviewed it. |
Only when AIR_INGEST_URL and AIR_INGEST_TOKEN are set; until then receipts wait in the outbox |
Scheduled data loads, outside the API
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| GitHubsource code and GitHub Actions |
Holds the source code, runs the test gate on every change, and runs the four workflows that write to the database: the two scheduled loads below, the taxonomy re-seed on every taxonomy change merged to main, and the demo desk seed, run by hand. |
The code; the database credentials, held as secrets of a GitHub environment for those four workflows; the public files the loads download. |
Always |
| FAA airman registerregistry.faa.gov |
The public mechanics and repairmen file, downloaded monthly. Only name, city, state and certificate kind are kept. |
A download request. |
Monthly |
| US Bureau of Labor Statisticswww.bls.gov |
The OEWS employment and wage survey behind the talent map, downloaded yearly. |
A download request. |
Yearly |
Loaded by the visitor's browser
| Service | What it does for SourcingNav | What it receives | Runs |
|---|
| cdnjs (Cloudflare)cdnjs.cloudflare.com |
Serves the open-source libraries (pdf.js, Mammoth, JSZip) a few pages use to read a file inside the browser. |
The browser's request for the library (its IP address and user agent). The file being read never leaves the browser through it. |
On those pages only |
| Images shown from where they were foundthe address each image was captured at |
A photo on a person's card is shown from the address it was found at, never copied: LinkedIn's image servers for one the extension read off the recruiter's screen, GitHub's for an avatar the person set there. The recruiter's own photo, when set in Settings, is shown the same way in the emails they send, and a company's logo on its job posting page is shown from the company's own site. |
The viewer's request for the image (its IP address and user agent). For a person's card that is the recruiter's browser; for a sent email, the candidate's mail app; for a posting, the applicant's browser. |
Only where an image is on file |
| YouTube, Vimeowww.youtube-nocookie.com, player.vimeo.com |
Plays a video a recruiter added to a job posting. |
The applicant's browser loads the player from them. |
Only on a posting with a video |
Pages the server fetches directly
When a recruiter pastes a job posting's address or a company's website, and when the footprint read follows a site a person linked themselves, the server fetches that public page itself. Every fetch is checked first: the host must resolve to a public address on a standard web port, and each redirect is checked again. The site sees a request from SourcingNav and nothing else.
Not used. The code still carries a helper for Together AI from an earlier design. Nothing calls it, and the guard test fails the day something does, until this page names it.
How each of these is used to meet a law is on the compliance page; how the data is protected on its way to them is on the security page; what candidates can do about it is in the privacy policy.