Data processing agreement
How Even Panel processes personal data for customers, and who helps.
Draft. This page hasn't been reviewed by a lawyer yet and isn't final. Questions: support@evenpanel.com.
Last updated 11 October 2026
Scope
This agreement applies when Even Panel processes personal data for a customer: candidates, employees and outside interviewers. It forms part of the terms of service.
Our commitments
We process personal data only on your documented instructions: to run the features you use.
Everyone with access is bound by confidentiality.
Data is encrypted in transit and at rest. Each company's records are kept apart by row-level security in the database.
AI judges see redacted feedback: no names, photos or school names. AI never makes a hiring decision.
We help you answer requests from candidates and employees, and with impact assessments.
We tell you without undue delay, and within 72 hours, after we learn of a personal data breach.
At the end of the subscription we delete your data after the 30-day export window.
Retention you control
Candidate files and transcripts are deleted on the retention schedule you set in Settings. Recordings are deleted as soon as they are transcribed.
Subprocessors
We use the subprocessors below. We'll give 30 days' notice of a new one by email; you can object, and if we can't resolve it you can end the subscription.
| Subprocessor | What for | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery, file storage (R2) | United States (global network) |
| Neon | Database hosting (Postgres) | United States |
| Resend | Sending email | United States |
| OpenRouter | Routing AI requests to model providers | United States |
| AI model providers through OpenRouter (for example Anthropic) | Drafting, evidence extraction and judging. No training on your data. | United States |
| Jev | First judge in the judge quorum, on redacted feedback | United States |
| Deepgram | Speech to text for uploaded recordings and voice notes. Audio is deleted once transcribed. | United States |
| Dodo Payments | Merchant of record: payments, tax and invoices | United States and India |
| WorkOS | Company sign-in (Google, Microsoft, Okta) | United States |
| Sentry | Error tracking. Error reports carry no candidate data. | United States |
Audits
Draft: audit rights, security documentation and certifications to be confirmed with counsel before launch.
Transfers
Standard contractual clauses (EU) and the UK addendum apply where needed.