# Corvalon HRM Sub-Processor List

Last updated: 2026-06-12

Corvalon uses the following sub-processors to deliver the Corvalon HRM Platform. This list is maintained in accordance with our Data Processing Agreement (DPA) and customers are notified at least 30 days before any new sub-processor is added.

---

## Infrastructure Sub-Processors

| Sub-Processor | Purpose | Data Processed | Location |
|---------------|---------|---------------|----------|
| **Amazon Web Services (AWS)** | Cloud hosting, compute, storage, database, networking | All customer data (encrypted at rest and in transit) | US East (N. Virginia); production backup copies replicated to US West (Oregon). Additional regions, including EU residency, are on the roadmap and not yet available |
| **Amazon RDS** | Managed PostgreSQL database | All structured customer data (encrypted via AES-256 at rest, Vault Transit for sensitive fields) | US East (N. Virginia) |
| **Amazon S3** | Object storage for documents, backups, audit archives | Uploaded documents, encrypted database backups, archived audit logs | US East (N. Virginia) |

Event processing and the Redis session cache run inside Corvalon's own AWS environment (a PostgreSQL transactional outbox and a self-hosted Redis container); they are platform components, not separate sub-processors.

## Security Sub-Processors

| Sub-Processor | Purpose | Data Processed | Location |
|---------------|---------|---------------|----------|
| **HashiCorp Vault** | Transit encryption engine for field-level encryption | Encryption/decryption operations for SSN, bank accounts, EIN, MFA secrets; Vault stores keys only (no plaintext data) | Self-hosted within Corvalon's AWS environment (US East) |

## AI/ML Sub-Processors

| Sub-Processor | Purpose | Data Processed | Location |
|---------------|---------|---------------|----------|
| **Anthropic** | AI-powered features (chatbot, NL query, document analysis) | User queries and feature context for AI requests. Queries may include personal data the user enters; automated redaction is applied to AI outputs (SSN, EIN, bank and routing numbers, and similar patterns), and input-side PII stripping is on the roadmap. AI features are controlled by per-tenant feature flags and a per-user opt-out enforced at the AI gateway. Anthropic's commercial API terms exclude API data from model training | United States |

## Monitoring Sub-Processors

| Sub-Processor | Purpose | Data Processed | Location |
|---------------|---------|---------------|----------|
| **Sentry** | Application error tracking and performance monitoring | Error stack traces, request metadata, and capture-site tags; reports may include tenant identifiers (automated pseudonymization is on the roadmap). Application code does not send employee personal data to Sentry | United States |

---

## Sub-Processors NOT Used

The following services are sometimes assumed but are **not** used by Corvalon HRM:

- No third-party analytics or advertising platforms
- No third-party identity providers operated by Corvalon (authentication is built-in; customers may optionally federate sign-in to their own OIDC or SAML identity provider, which acts as the customer's vendor, not a Corvalon sub-processor)
- No external payroll processing vendors (payroll engine is built-in)
- No external data warehouses or lakes (analytics runs on primary database)

---

## Change Notification Process

1. Corvalon publishes changes to this sub-processor list at least **30 days** before the new sub-processor begins processing customer data.
2. Customers are notified via email to the designated privacy contact on their account.
3. Customers may object to a new sub-processor within 30 days of notification per the terms of the DPA.
4. This list is always available at the Corvalon Trust Center.

---

## Contact

For questions about our sub-processors or to register an objection:

- **Email:** privacy@corvalonhrm.com
- **Trust Center:** [https://corvalonhrm.com/trust](https://corvalonhrm.com/trust)