For companies
Data processors
These are all the vendors that process personal data for Referencepas – what they do, where the data is and their own data processing agreements.
Supabase
Database and login
- Data:
- Accounts, passports, references, invitations
- Transfer:
- Standard contractual clauses for any support from the USA
Vercel
Website hosting
- Data:
- Traffic and technical logs (IP addresses)
- Transfer:
- Standard contractual clauses
Resend
Sending emails
- Data:
- Names, email addresses and email content
- Transfer:
- Standard contractual clauses for any support from the USA
Idura
MitID confirmation
- Data:
- Name and the company's CVR if relevant – never CPR with us
- Transfer:
- No transfer outside the EU
Anthropic
AI reading of CVs, email domain checks and the chat assistant
- Data:
- CV text and chat messages (not stored) and public company information
- Transfer:
- Standard contractual clauses. Data is not used to train AI
Stripe
Payments and invoices
- Data:
- The company's payment details
- Transfer:
- EU-US Data Privacy Framework and standard contractual clauses
- Role:
- Independent data controller for payments
Data processing agreement with Referencepas
For the references themselves, Referencepas is the independent data controller. If you invite candidates through Referencepas or our API, we process name and email on your behalf – that part is covered by our data processing agreement. Write to us, and we will send it for signing.
Customers with a data processing agreement are notified at least 30 days before we start using a new sub-processor. Also read our privacy policy and security. Last updated 28 October 2026.