Subprocessor List Updated March 18, 2026
Jombone Inc. uses a limited set of trusted third-party service providers (“Subprocessors”) to deliver the Jombone Platform. These providers may process Customer Data as defined in our Master Services Agreement and Data Processing Addendum (DPA §4.2).
We conduct due diligence on each provider and require them to meet the same data protection standards we uphold for our customers. In accordance with our DPA, we will notify customers at least 14 days before engaging any new Subprocessor by updating this page.
Questions or objections? If you have questions about a specific Subprocessor, wish to exercise your objection rights under our DPA, or require additional information for your own compliance purposes, contact us at
[email protected].
Infrastructure & Cloud Hosting
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Amazon Web Services | Cloud Infrastructure | 🇺🇸 US 🇨🇦 Canada | Platform hosting, data storage, compute, and content delivery for all Jombone services | aws.amazon.com |
Communications — Email, SMS & Voice
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| SendGrid / Twilio | Email, SMS & Voice | 🇺🇸 US | Transactional email delivery (invoices, password resets, onboarding notifications), SMS alerts, shift reminders, and voice notifications to candidates and clients | twilio.com |
| Nylas | Email & Calendar Integration | 🇺🇸 US | Email and calendar sync between the Jombone Platform and Customer’s existing email/calendar accounts (e.g., Gmail, Outlook) to streamline scheduling and communication workflows | nylas.com |
Background Screening & Identity Verification
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Certn | Background Checks & Identity Verification | 🇺🇸 US 🇨🇦 Canada | Criminal background checks, identity verification, and employment screening for candidates. Supports North American jurisdictions. Canadian results governed by applicable provincial human rights legislation and the Criminal Records Act (R.S.C. 1985, c. C-47) | certn.co |
Electronic Signatures & Documents
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| SignNow | e-Signature & Document Management | 🇺🇸 US | Electronic signing of offer letters, employment agreements, onboarding documents, and client contracts. Billed per envelope on actual usage. Enforceable under ESIGN Act (US) and Ontario Electronic Commerce Act (Canada) | signnow.com |
Mapping & Location
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Google Maps Platform | Mapping & Geolocation | 🇺🇸 US | Address validation, job site mapping, and candidate proximity matching within the Platform. Location data is used solely for operational purposes within the Platform | Google Maps |
Job Distribution
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Job Target | Job Board Distribution | 🇺🇸 US | Multi-channel job posting and distribution to job boards and aggregators on behalf of Customer. Job listing data and limited candidate information may be processed to facilitate applications | jobtarget.com |
Security & Compliance
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Drata | Compliance & Security Monitoring | 🇺🇸 US | Continuous security compliance monitoring, SOC 2 audit preparation, and automated evidence collection. Drata may process limited infrastructure and access log data as part of Jombone’s compliance program | drata.com |
Customer Support
| Subprocessor | Service | Data Location | Purpose | Website |
|---|
| Intercom | Customer Support & In-App Messaging | 🇺🇸 US | In-platform help center, live chat support, support ticket management, and customer success communications. User profile and conversation data may be processed to deliver support services | intercom.com |
Changes to This List
Jombone updates this page before engaging any new Subprocessor and notifies affected customers at least 14 days in advance in accordance with our Data Processing Addendum (§4.2). The “Last Updated” date at the top of this page reflects the most recent change to this list.
If you wish to object to a new Subprocessor engagement, please send written notice to [email protected] within 14 days of receiving notification. If we are unable to resolve your concern, you may terminate the affected services with 30 days’ written notice as set out in the DPA.
