Sub-processor register

Who touches your information, who does not, and how we know.

Every company that processes personal information for Futureful, what each one receives, and the services that receive none. Derived by enumerating every outbound request our servers make, and held there by a check that fails our build when a new one appears.

Effective: September 2, 2026
Questions: info@futureful.app
Also read: Privacy Policy Your protections
Keep a copy

Derived, not remembered

Nineteen external services enumerated from the code, each one read to decide whether personal information reaches it. A build check fails if a new one appears in neither list.

The negative list too

Most registers publish only who receives your data. The useful half is who does not, and why, so that half is published here as well.

And what we cannot produce

No executed data agreement, no NIST attestation, no VPAT, no residency warranty. Each is a program to run, not a page to write, and pretending otherwise is worse than the gap.

Contents

What this register is, and how it is built
The register
AI models, retention and training
Services that receive no personal information
Connections you make yourself
What we do not have yet
How this page changes
Reaching a person

What this register is, and how it is built

This is every company that processes personal information on Futureful’s behalf, what each one does, and what each one actually receives. It is the same list that appears inside the privacy policy, published at its own address because that is where a procurement questionnaire needs to point.

It was not assembled from memory. Every outbound request in our server code is enumerated, 19 distinct external services today, and each one is read to decide whether personal information actually reaches it. A check in our build fails if a new one ever appears in neither this register nor clause 04, so this page cannot quietly go out of date.

The register

What it does: Database, sign-in, and file storage
What it receives: Your account, your profile and answers, your uploaded files
What it does: Hosting and content delivery
What it receives: Ordinary web request records
What it does: AI models for reading and writing language
What it receives: The text or document image sent with a request
What it does: Routes some AI requests, pinned to providers that do not retain or train on them
What it receives: The text or audio sent with a request
What it does: Turns written text into spoken audio, for the practice interview
What it receives: The text we speak aloud, which can be written for you
What it does: Sends platform email
What it receives: Your email address and the content of that message
What it does: Alternate email sender
What it receives: Your email address and the content of that message
What it does: Checks that an email address is deliverable, on the public sign-up form
What it receives: The email address only

Companies that process personal information on Futureful's behalf
Provider	What it does	What it receives
Supabase	Database, sign-in, and file storage	Your account, your profile and answers, your uploaded files
Netlify	Hosting and content delivery	Ordinary web request records
Anthropic	AI models for reading and writing language	The text or document image sent with a request
OpenRouter	Routes some AI requests, pinned to providers that do not retain or train on them	The text or audio sent with a request
ElevenLabs	Turns written text into spoken audio, for the practice interview	The text we speak aloud, which can be written for you
Google Workspace	Sends platform email	Your email address and the content of that message
Resend	Alternate email sender	Your email address and the content of that message
MillionVerifier	Checks that an email address is deliverable, on the public sign-up form	The email address only

Two that appear in this product and are not on the list because no job seeker reaches them: HubSpot holds employer contacts only, and Stripe handles employer payment. A job seeker is never charged for anything.

AI models, retention and training

The question a district and a security reviewer both ask first, answered as precisely as we can:

What the code does. Every request we route through OpenRouter carries a provider pin that permits only upstreams which neither retain nor train on the payload. It is set on every call, and the reason written beside it in the source is that these prompts can carry a minor’s information. Requests to Anthropic go to Anthropic directly.
We do not train anything on you. We do not sell personal information to anyone for model training, and we do not train a model of our own on it.
What is not in our gift. A contractual no-training term with each model vendor is a signed agreement, not a line of code. We have the technical control today. Where we do not yet hold the paper, we say so rather than imply it.
Audio. The spoken practice interview sends your current turn to a model so it can hear you. We do not store your recorded audio. The only audio we keep is speech we generate ourselves.

Services that receive no personal information

Published on purpose. Most registers list only who receives your data; the useful half is who does not, and why. Our server contacts each of these, and none of them receives anything about a person:

Why it receives nothing: Job-posting connectors. We fetch listings from them. We send no person to them.
Why it receives nothing: Public grants data, read-only.
Why it receives nothing: Operations and integration-health tooling only. No job seeker information.
Why it receives nothing: Employer-side sourcing tools. Not on any job-seeker path.
Why it receives nothing: Only if you connect your own calendar yourself. See clause 05.

External services that receive no personal information
Service	Why it receives nothing
Ashby, Lever, SmartRecruiters	Job-posting connectors. We fetch listings from them. We send no person to them.
Grants.gov	Public grants data, read-only.
Groq	Operations and integration-health tooling only. No job seeker information.
Brave Search, SerpApi, Apollo	Employer-side sourcing tools. Not on any job-seeker path.
Google Calendar, Microsoft Graph	Only if you connect your own calendar yourself. See clause 05.

Connections you make yourself

If you connect a calendar, Google or Microsoft, we create and read the interview events we agreed to put there, in your own account, at your instruction. That is a connection you make and can end, not a company we hand your information to, so it is listed separately and deliberately.

What we do not have yet

A register that only lists strengths is a sales page. These are the things a school district or a security reviewer will ask for that we cannot produce today:

No executed data privacy agreement. We can work from your paper. We do not have a signed NDPA or a General Offer, and an executed one requires a first agency in any case.
No NIST Cybersecurity Framework attestation and no penetration test. Worth noting for anyone benchmarking us: the standard education data agreement names GESS, NIST CSF, NIST 800-53, 800-171, ISO 27000, CIS Controls and CMMC as its framework options. SOC 2 is not among them, so a SOC 2 report would not be the artifact that agreement asks for.
No third-party accessibility audit and no VPAT. What we do have is on the accessibility page, including the gaps.
No documented data-residency guarantee. Our providers are United States companies and your information is processed in the United States. We have not audited and cannot yet warrant region pinning, so we do not claim it.

Every one of those is a program to run, not a page to write. Publishing a security page that warrants controls we do not operate would turn a product gap into a misrepresentation, which is worse than the gap. When each becomes real it appears here, dated.

How this page changes

The effective date at the top changes with the list. Because the register is derived from the code and held there by a build check, a new service cannot reach production without either appearing here or being recorded in clause 04 with the reason it receives nothing. If you are relying on this page in a review and want to be told when it changes, write to info@futureful.app and we will tell you.

Reaching a person

info@futureful.app for a security questionnaire, a data agreement, or anything on this page. The same address answers the privacy policy, the terms and accessibility. A real person reads it.

FUTUREFUL · SUB-PROCESSOR REGISTER · REV A