AI note taker subprocessors: which companies get your interview recordings, and how to read the list

For every cloud tool we checked, yes. As of November 2026, the AI note takers and research tools below send interview audio to an outside speech-to-text company and transcripts to one or more outside AI model providers, and they name those companies as subprocessors: Metaview lists Anthropic, OpenAI, AssemblyAI and Rev; BrightHire lists Anthropic, OpenAI, Microsoft and Zoom for summaries and AWS, AssemblyAI, Deepgram and Rev for transcription; Greenhouse's Notetaker names Recall.ai and OpenAI; Granola lists Anthropic, OpenAI, xAI and others; and the research tool Dovetail lists Anthropic and Google Cloud for its AI features. Whether those providers may keep or train on what they receive is set by contract terms that the lists rarely show.

This page explains what a subprocessor list is, where to find one, what five vendors' lists actually say, and what to check before candidate interviews go through a tool. Training policies are compared in do AI note takers train on your interview recordings, and what AI providers keep is explained in zero data retention for AI note takers.

What is a subprocessor list?

When a recruiting team uses a note taker, the vendor processes candidates' data on the team's behalf. A subprocessor is any other company the vendor hands that data to: the cloud host, the speech-to-text service that turns audio into a transcript, the AI model provider that writes the summary, and support, email and monitoring tools. The list is the vendor's public record of who those companies are, what each does and where.

The practice comes from European data protection law. Article 28(2) of the GDPR says "the processor shall not engage another processor without prior specific or general written authorisation of the controller," and, under a general authorisation, must inform the controller of intended additions or replacements, "thereby giving the controller the opportunity to object." Article 28(4) requires the same data protection obligations to be passed down to each subprocessor by contract. A published list plus a way to hear about changes is how most vendors meet that. US law has no general equivalent, but most US vendors publish a list anyway and refer to it in their data processing agreement. This is general information, not legal advice.

Where do vendors publish their subprocessor lists?

• A subprocessors page on the main website, often linked from the footer or the privacy policy.
• A trust center on a separate address such as trust.vendor.com. Several load only in a full browser, so a link that looks empty in a preview may be fine in Chrome or Safari.
• The data processing agreement, as an annex or by reference to the web page.
• The help center, sometimes as a product-specific FAQ that names the providers behind one feature.
• On request, sometimes behind an NDA. If you cannot find one, ask for it in writing.

What do five vendors' subprocessor lists actually show?

Each row is taken from the vendor's own subprocessor list, trust center or help page, linked, as of November 2026. "Not stated" means the pages we read do not say; ask the vendor.

Three patterns stand out. Every vendor uses more than one outside AI or speech company, and some use many. The storage region is not the processing region. And none of the lists says how long each AI provider keeps what it receives; where a vendor addresses that, it does so on a different page.

What should you look for on a subprocessor list?

1. Which entries touch interview content. Billing and email tools rarely matter for candidates; the cloud host, speech-to-text, AI model, search and storage entries do. Some lists mark this for you: Fathom's trust center flags each subprocessor that "Handles Meeting Content Data" and whether it is "Forbidden from training AI on Fathom Customer Data" (Fathom Trust Center).
2. Every AI model provider, by name. Count them. A list with five model providers means a transcript may go to any of them, depending on the feature. Check each against your own approved-vendor list.
3. Evaluation, testing and annotation entries. An entry described as evaluating or testing AI performance may see real transcripts. Ask what data it receives and whether people review it.
4. Location for each entry, not just the vendor's hosting region. If you hire in the EU or UK, ask which transfer mechanism covers each provider outside it.
5. Retention and zero data retention terms. The list will not tell you. Ask whether each AI and speech-to-text provider keeps inputs and outputs, and for how long; the zero data retention guide explains what the providers' own terms allow.
6. Training terms for each provider, and for the vendor's own models.
7. How you hear about changes: email notice, a subscription, or only a page that changes silently. Under a GDPR general authorisation, you are owed notice and a chance to object.
8. The date. A list without a version date cannot tell you what applied when a given interview was recorded. Save a dated copy with your vendor file.

How do you check a vendor in 30 minutes?

1. Find the subprocessor list and the data processing agreement. Save both with today's date.
2. Mark every entry that receives audio, transcripts, notes or scores.
3. For each marked entry, note its purpose and location. Compare the locations with where your candidates are.
4. Read the vendor's security or AI page for training and retention statements, and match each to a named provider. Anything you cannot match goes on your question list.
5. Check how change notices work and subscribe if you can.
6. Send the questions below for every gap, and get the answers into the DPA rather than an email thread; the DPA guide for recruiting software covers the clauses.

Questions to send when the list is missing or vague

These fit into section 5 of the AI note taker security questionnaire:

SUBPROCESSOR QUESTIONS FOR [VENDOR]   Date sent: [ ]

1. Please send your current subprocessor list with each company's
   purpose, processing location and the list's version date.
2. Which subprocessors receive interview audio, transcripts, notes,
   summaries or scores? Which receive candidate names?
3. For each AI model and speech-to-text subprocessor: may it retain
   inputs or outputs, for how long, and is zero data retention (or the
   provider's equivalent) enabled for the account that processes our data?
4. For each of them: may it use our data to train or improve any model?
   Which contract term prevents it?
5. Does any subprocessor, or any of your staff, review or annotate real
   transcripts for evaluation, testing or quality? Can we opt out?
6. If data is stored in [UK / EU], which subprocessors process it outside
   that region, and under which transfer mechanism?
7. How much notice do you give before adding or replacing a subprocessor,
   how is it sent, and how do we object?

What should you tell candidates?

Only what you have confirmed. One sentence in your candidate privacy notice covers it, filled in from the list: "Our interview note-taking tool, [vendor], uses [speech-to-text provider] to transcribe interviews and [AI providers] to draft notes, under contracts that [do not allow them to train on interview content]." Leave out the last part unless the vendor has confirmed it in writing. The rest of the wording is in the candidate privacy notice template, and where each tool stores what it keeps is in where AI note takers store interview data.

We make Interview Signal; its security page lists its subprocessors, including Groq and OpenAI for speech-to-text and Cerebras, Groq and OpenAI for text generation, all in the United States.

What does a subprocessor list not tell you?

• Which feature sends what to whom. A provider may be used only for one feature you never switch on. Ask, rather than assume either way.
• Whether the recording is lawful. Consent comes first, under the recording laws where you and the candidate are.
• What happens to copies you make. Notes pasted into your ATS or email follow your own retention rules.

Not legal advice. Vendor lists are quoted from their own pages as of November 2026 and change often; check each linked page and its date before you rely on a row.