Fill Technology AB — The AI procurement system for your consultant workforce
A data processor is a third-party data processor engaged by Fill who has or potentially will have access to or process data handled by Fill.
Our sensitivity classifications are based on the traffic light terminology: Red, Yellow and Green.
| Sensitivity classification | Description |
|---|---|
| Red | Red Data is typically highly restricted data, including health data and financial data. |
| Yellow | Yellow Data is typically restricted data and may include limited personal information. |
| Green | Green Data is standard data that does not include any personal information. |
We classify our data into different categories to ensure that we handled it appropriately given the sensitivity level.
| Data classification | Description | Sensitivity classification |
|---|---|---|
| Device information | Information about the user's device such as browser, browser version, etc. | Green |
| User identifier | Identifiers for users in our system | Green |
| Contact information | Information that makes it possible for us to contact the user, such as name and email | Yellow |
| IP address | IP address of the user's device | Yellow |
| Suitability information | Resumes, candidate descriptions and performance | Yellow |
For each processor that we use, we apply the principles of least privilege. This means that each third-party system shall only have access to the minimum data required to fulfill its purpose.
We have entered into adequate agreements with all of our sub-processors in order to safeguard data.
The table below sets out the processors we use. Processors marked Optional are used only where a customer's setup includes them.
| Name | Type of service | URL | Data center | Purpose | Data subject | Data processed | Contact information | Sensitivity | Optionality |
|---|---|---|---|---|---|---|---|---|---|
| Slack | Notifications / team messaging | www.slack.com | Germany | Notifications in systems related to problems and disruptions in key workflows, and internal notifications to Fill's team | Buyer, Supplier, Candidate | User ID, Supplier ID, assignment ID, Consultant ID, job descriptions | Privacy contact: privacy@slack.com; privacy & GDPR info: https://slack.com/trust/privacy-at-slack | Green | Mandatory |
| AWS | Cloud infrastructure & storage | www.aws.com | Sweden | All data that we control. AWS support personnel are not allowed to access data | Buyer, Supplier, Candidate | Name, email address, resume | Data protection contact (EU): aws-EU-privacy@amazon.com (AWS EMEA SARL) | Yellow | Mandatory |
| Mailersend | Email notification (transactional) | www.mailersend.com | EU | Email notifications to users regarding activity in the platform | Buyer, Supplier, Candidate | Email address | Privacy contact: info@mailersend.com; privacy policy: https://www.mailersend.com/legal/privacy-policy | Yellow | Mandatory |
| Cometchat | In-app communication (chat) | www.cometchat.com | EU | Communication between users | Buyer, Supplier, Candidate | Name, email address | Privacy / GDPR contact via CometChat privacy notice: https://www.cometchat.com/legal-privacy-policy (contact section) | Yellow | Mandatory |
| Auth0 | Log-in authentication (IDaaS) | www.auth0.com | EU | Log in | Buyer, Supplier | Email address | Privacy/DPO contact: privacy@okta.com (covers Auth0 as Okta service) | Yellow | Mandatory |
| Cronofy | Calendar integration for scheduling interviews and meetings | www.cronofy.com | Germany | Calendar bookings and syncing | Buyer, Candidate | Email address | Privacy contact: privacy@cronofy.com; privacy notice: https://docs.cronofy.com/policies/privacy-notice/ | Yellow | Mandatory |
| Intercom | Support chat / in-app messaging | www.intercom.com | Germany | Support chat | Buyer, Candidate | Email address, name | Privacy contact via Privacy Request Form linked from privacy policy: https://www.intercom.com/legal/privacy | Yellow | Mandatory |
| Microsoft Azure AI | Large language model (AI functions) | www.microsoft.com | Sweden | AI-based functions. Microsoft may keep prompts and answers for up to 30 days, in the same region, to detect abuse of its service | Buyer, Supplier, Candidate | Job descriptions, resumes | EU Data Protection Officer, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; privacy request webform: https://aka.ms/privacyresponse; privacy statement: https://privacy.microsoft.com | Yellow | Optional |
| Amazon Bedrock (AWS) | Large language model (AI functions) | aws.amazon.com/bedrock | EU | AI-based functions. Amazon does not share the data with the model provider, Anthropic, and does not keep prompts and answers after responding | Buyer, Supplier, Candidate | Job descriptions, resumes | Data protection contact (EU): aws-EU-privacy@amazon.com (AWS EMEA SARL) | Yellow | Optional |
| OneFlow | Contracting & e-signature | www.oneflow.com | Sweden | Contracting | Buyer, Supplier, Candidate | Email address, name | Privacy contact: security@oneflow.com; general support: support@oneflow.com | Yellow | Optional |
| Sentry | Error & performance monitoring | sentry.io | Germany | Bug & error tracking | Buyer, Supplier, Candidate | Session data | Privacy & GDPR info, including contact, via https://sentry.io/privacy/ and security/trust pages | Green | Mandatory |
| Google Workspace | Email service & file storage | google.com | EU | Email client and file storage | Buyer, Supplier | Email address, name | Data Protection Office: data-protection-office@google.com (Google DPO contact) | Yellow | Mandatory |
| PostHog | Product analytics & session insights | posthog.com | EU (Frankfurt, Germany) | Product analytics: workflow completion rates, drop-off points, feature adoption | Buyer, Supplier, Candidate | Pseudonymized user ID, session metadata | Privacy contact: privacy@posthog.com; DPO: Charles Cook (VP Operations); privacy policy: https://posthog.com/privacy | Green | Mandatory |