ICAN
Sub-processors
Last updated 9 August 2026 (v1.0)
These are the third parties that process personal data on ICAN MENA’s behalf to operate the ICAN platform. They are engaged under written terms that impose data protection obligations no less protective than those in our Data Processing Addendum. This page is the register that Addendum refers to.
1. Core platform
Engaged for every customer — the Service does not operate without them.
| Sub-processor | Purpose | Data involved | Processing region |
|---|---|---|---|
| Supabase | Database, authentication, file storage and realtime. | All customer programme data, account records and uploaded files. | Frankfurt, Germany (eu-central-1) |
| Vercel | Application hosting, serverless compute and CDN. | Request data in transit; logs and request metadata. | EU edge and function regions; global CDN for static assets |
| Sentry | Error monitoring and client-side session replay. | Error reports, stack traces, request metadata and replayed UI interactions. | EU |
2. Feature-specific
Engaged only where the relevant feature is used. A customer who does not use the AI features, for example, has no data processed by Anthropic.
| Sub-processor | Purpose | Data involved | Processing region |
|---|---|---|---|
| Anthropic | AI features: CV structuring and scoring, job-description generation and parsing. | The text submitted to the feature — typically a CV or a job description. | United States |
| Resend / SendGrid | Transactional email delivery (invitations, notifications, digests). | Recipient name and email address, and the message content. | EU / United States |
| Google (Workspace APIs) | Reading ICAN’s own shared mailboxes (talent@, projects@) to capture CVs and client requests. | Messages and attachments delivered to those ICAN mailboxes. | EU / United States |
| Zoho (Books) | Invoicing and accounting for ICAN MENA’s own billing. | Billing contact details and invoice line data. No candidate or expert programme data. | Per the configured Zoho data centre |
3. Where data is stored
The primary data store is in Frankfurt, Germany (eu-central-1). Customer programme data — candidate and expert records, projects, sessions, notes and uploaded files — is held there. Some sub-processors above operate outside the EU for the specific, limited purposes described; those transfers are covered by the safeguards in “International processing and transfers” in the Addendum. We do not replicate the primary data store outside the EU without the customer’s agreement.
4. AI providers and training
Content sent to AI features is processed under terms that prohibit the provider from using it to train their models. AI output is decision support: a person at the customer organisation reviews it and remains accountable for any hiring or engagement decision. ICAN does not use automated decision-making that produces legal or similarly significant effects without the assessment and safeguards described in the Privacy Notice.
5. No silent vendors
A provider is added to this register before it is permitted to receive or access client personal data as an ICAN sub-processor — not afterwards. That covers hosted databases and storage, application hosting, support providers with production access, email or SMS providers that receive client personal data, analytics and error-monitoring tools that receive identifiable client personal data, document and e-signature services, AI providers that receive client personal data, and backup or security providers with access to it.
A vendor ICAN buys a service from is not listed here merely because we pay for it. This register names providers that can reach client personal data.
For each provider, ICAN maintains an internal record covering the exact contracting legal entity, the service and purpose, categories of data, hosting country, any remote support or access countries, onboarding date, security and privacy due-diligence status, the signed data-processing agreement, any transfer mechanism required, the review date and the internal owner.
6. Changes and how to object
We will give at least 30 days’ notice before a new sub-processor starts processing customer personal data, by updating this page and notifying the administrative contact for each affected customer.
A customer may object on reasonable data-protection grounds within that notice period by writing to privacy@icanmena.com. We will work in good faith to offer a change or an alternative; if none is reasonably available, the customer may terminate the affected part of the Service without penalty for the remainder of its term.
7. Contact
Questions about this register, or a request for the current list in writing: privacy@icanmena.com.