Sub-processors
Version 1.0 · effective 24 September 2026
The companies that process personal data for Talent Mirror on Tonic’s behalf, what they do and where. Each is bound by data processing terms. Transfers outside the UK and EEA are covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
| Company | What it does | Where | What it handles |
|---|---|---|---|
| Google Cloud EMEA Limited / Google LLC (Google Cloud and Firebase) | Database, background processing, file storage, website hosting and sign-in | London (database and processing), Turin (exported files), the Netherlands (website). Sign-in is not tied to one region. | Everything held in Talent Mirror |
| Anthropic, PBC | AI models that find material, code it against the twelve factors, write summaries and answer questions | United States | Public material about employers (after personal identifiers are removed), audit briefs, report data and questions to the assistant |
| Functional Software, Inc. (Sentry) | Error monitoring | European Union (Frankfurt) | Technical details of errors. Personal data capture is switched off. |
| Google Ireland Limited / Google LLC (Google Analytics for Firebase) | Usage analytics — which pages and features are used. Only when you accept analytics cookies. | May process outside the UK and EEA | Pseudonymous identifiers, pages visited, product events, device, browser and approximate location. No names, email addresses, audit titles or client names. |
| Google LLC (Gemini API) | Backup AI model, used only if the primary provider is unavailable | May process outside the UK and EEA | The same as Anthropic, when in use |
Tonic’s own business systems (Google Workspace and Basecamp) are described in the Security & Trust Centre. We will update this page before adding or replacing a sub-processor.