Atlas Trust Center
Sub-Processors
Atlas (Talent Phantom, Inc.) uses the third parties below to deliver its service. This page is the authoritative list. A machine-readable JSON version is available at /api/trust/sub-processors for security teams that want to monitor for changes.
Version: 2026-06-13.v1·Last updated: June 13, 2026·10 sub-processors
Large language model inference (GPT-5.4 + GPT-5.4-mini) powering candidate assessment, AI semantic search, location verification, outreach drafts, and the Workforce Economics matching engine.
Data Processed
- ·Job descriptions
- ·Candidate names + titles + employer info during scoring
- ·Roster employee records during AI query analysis
- ·Outreach draft context
Data Location
United States (Microsoft Azure)
Certifications
SOC 2 Type IIISO 27001CSA STAR Level 2
Atlas-applied controls
- ✓Zero Data Retention (ZDR) enforced on every API call — request bodies are not logged for abuse monitoring
- ✓API mode only — no ChatGPT consumer endpoints used
- ✓OpenAI's published policy: API data is NEVER used to train OpenAI models
Primary application database (PostgreSQL). Stores all workspace, candidate, roster, opportunity, and analysis records.
Data Processed
- ·All workspace data
- ·Candidate records (incl. names, LinkedIn URLs, contact info when revealed)
- ·Customer employee rosters
- ·Pipeline + opportunity data
- ·Outreach draft + sent history
Data Location
United States (AWS US-East-1)
Certifications
SOC 2 Type IIHIPAA-eligibleISO 27001
Atlas-applied controls
- ✓Row-Level Security (RLS) enabled on every table
- ✓Service-role key access only from server-side code
- ✓Workspace isolation enforced via workspace_id filter on every query
User authentication, session management, and SSO/OAuth integration. Does not see candidate or employee data.
Data Processed
- ·User account email + name
- ·Login sessions + device info
- ·OAuth tokens (Gmail / Outlook for outreach sending)
Data Location
United States
Certifications
SOC 2 Type IIGDPR-compliant
Application hosting, edge compute, CDN. Atlas's Next.js app runs on Vercel's serverless function platform.
Data Processed
- ·All HTTP request traffic to Atlas
- ·Function execution logs (PII-scrubbed per Atlas logging policy)
Data Location
United States + global edge (Cloudflare-equivalent CDN)
Certifications
SOC 2 Type IIISO 27001PCI DSS
Atlas-applied controls
- ✓Server-side logs are stripped of customer PII before they reach Vercel's log infrastructure (see Atlas Logging Policy)
- ✓Default 12-day function log retention; can be reduced or disabled per customer DPA
Render
Render Services, Inc.
Hosts the Atlas methodology API (FastAPI). Receives job descriptions during Phantom Search and returns ranked candidate evidence.
Data Processed
- ·Job descriptions during search
- ·Search-time intermediate engine outputs
Data Location
United States
Certifications
SOC 2 Type II
ContactOut
ContactOut, Inc.
Primary contact enrichment provider. Used for: (1) name+company verification on candidate LinkedIn URLs, (2) Reveal Contact action (returns work + personal emails + phone numbers).
Data Processed
- ·Candidate name + current company (verification)
- ·LinkedIn URL (Reveal Contact)
Data Location
United States
Certifications
SOC 2 Type IIGDPR-compliant
People Data Labs (PDL)
People Data Labs, Inc.
Fallback contact enrichment provider when ContactOut returns no match. Same use cases as ContactOut.
Data Processed
- ·Candidate name + current company
- ·LinkedIn URL
Data Location
United States
Certifications
SOC 2 Type IIGDPR-compliant
Subscription billing and payment processing for Atlas customer plans.
Data Processed
- ·Customer billing email + name
- ·Payment method (handled by Stripe; Atlas never sees card numbers)
- ·Subscription status
Data Location
United States
Certifications
PCI DSS Level 1SOC 2 Type IIISO 27001
Transactional email delivery (account confirmations, billing notifications). NOT used for candidate outreach sending — that goes through the customer's own Gmail/Outlook OAuth connection.
Data Processed
- ·Atlas user email addresses
- ·Transactional message content (no customer roster or candidate data)
Data Location
United States
Certifications
SOC 2 Type II
Google Workspace (Gmail)
Google LLC
OAuth-based send of recruiter outreach emails through the recruiter's own Gmail account. Atlas obtains a refresh token from the user; sent messages go through Google's infrastructure under the customer's own account, not Atlas's.
Data Processed
- ·OAuth refresh + access tokens
- ·Outreach email body content during send
Data Location
Google's global infrastructure (per customer's Google Workspace contract)
Certifications
SOC 2 Type IIISO 27001FedRAMP ModerateHIPAA-eligible
Customers will be notified of material changes to this list at least 30 days before they take effect. Subscribe to changes by polling /api/trust/sub-processors and monitoring the version field. For DPA requests or security review documentation, contact trust@atlas.ai.