Who touches your information, who does not, and how we know.

This is every company that processes personal information on Futureful’s behalf, what each one does, and what each one actually receives. It is the same list that appears inside the privacy policy, published at its own address because that is where a procurement questionnaire needs to point.

It was not assembled from memory. Every outbound request in our server code is enumerated, 19 distinct external services today, and each one is read to decide whether personal information actually reaches it. A check in our build fails if a new one ever appears in neither this register nor clause 04, so this page cannot quietly go out of date.

Supabase

What it does

Database, sign-in, and file storage

What it receives

Your account, your profile and answers, your uploaded files

Netlify

What it does

Hosting and content delivery

What it receives

Ordinary web request records

Anthropic

What it does

AI models for reading and writing language

What it receives

The text or document image sent with a request

OpenRouter

What it does

Routes some AI requests, pinned to providers that do not retain or train on them

What it receives

The text or audio sent with a request

ElevenLabs

What it does

Turns written text into spoken audio, for the practice interview

What it receives

The text we speak aloud, which can be written for you

Google Workspace

What it does

Sends platform email

What it receives

Your email address and the content of that message

Resend

What it does

Alternate email sender

What it receives

Your email address and the content of that message

MillionVerifier

What it does

Checks that an email address is deliverable, on the public sign-up form

What it receives

The email address only

Two that appear in this product and are not on the list because no job seeker reaches them: HubSpot holds employer contacts only, and Stripe handles employer payment. A job seeker is never charged for anything.

The question a district and a security reviewer both ask first, answered as precisely as we can:

• What the code does. Every request we route through OpenRouter carries a provider pin that permits only upstreams which neither retain nor train on the payload. It is set on every call, and the reason written beside it in the source is that these prompts can carry a minor’s information. Requests to Anthropic go to Anthropic directly.
• We do not train anything on you. We do not sell personal information to anyone for model training, and we do not train a model of our own on it.
• What is not in our gift. A contractual no-training term with each model vendor is a signed agreement, not a line of code. We have the technical control today. Where we do not yet hold the paper, we say so rather than imply it.
• Audio. The spoken practice interview sends your current turn to a model so it can hear you. We do not store your recorded audio. The only audio we keep is speech we generate ourselves.

Published on purpose. Most registers list only who receives your data; the useful half is who does not, and why. Our server contacts each of these, and none of them receives anything about a person:

Ashby, Lever, SmartRecruiters

Why it receives nothing

Job-posting connectors. We fetch listings from them. We send no person to them.

Grants.gov

Why it receives nothing

Public grants data, read-only.

Groq

Why it receives nothing

Operations and integration-health tooling only. No job seeker information.

Brave Search, SerpApi, Apollo

Why it receives nothing

Employer-side sourcing tools. Not on any job-seeker path.

Google Calendar, Microsoft Graph

Why it receives nothing

Only if you connect your own calendar yourself. See clause 05.

If you connect a calendar, Google or Microsoft, we create and read the interview events we agreed to put there, in your own account, at your instruction. That is a connection you make and can end, not a company we hand your information to, so it is listed separately and deliberately.

A register that only lists strengths is a sales page. These are the things a school district or a security reviewer will ask for that we cannot produce today:

• No executed data privacy agreement. We can work from your paper. We do not have a signed NDPA or a General Offer, and an executed one requires a first agency in any case.
• No NIST Cybersecurity Framework attestation and no penetration test. Worth noting for anyone benchmarking us: the standard education data agreement names GESS, NIST CSF, NIST 800-53, 800-171, ISO 27000, CIS Controls and CMMC as its framework options. SOC 2 is not among them, so a SOC 2 report would not be the artifact that agreement asks for.
• No third-party accessibility audit and no VPAT. What we do have is on the accessibility page, including the gaps.
• No documented data-residency guarantee. Our providers are United States companies and your information is processed in the United States. We have not audited and cannot yet warrant region pinning, so we do not claim it.

Every one of those is a program to run, not a page to write. Publishing a security page that warrants controls we do not operate would turn a product gap into a misrepresentation, which is worse than the gap. When each becomes real it appears here, dated.

The effective date at the top changes with the list. Because the register is derived from the code and held there by a build check, a new service cannot reach production without either appearing here or being recorded in clause 04 with the reason it receives nothing. If you are relying on this page in a review and want to be told when it changes, write to info@futureful.app and we will tell you.

info@futureful.app for a security questionnaire, a data agreement, or anything on this page. The same address answers the privacy policy, the terms and accessibility. A real person reads it.