Greenhouse

Downstream

Who's behind Greenhouse, as listed in its own subprocessor documents. 16 subprocessors.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. training-adjacent sentence found but not classifiable by rules

Documents read

• privacy policy https://www.greenhouse.com/privacy-policyHTTP 200 · 2026-10-10
• subprocessors https://trust.greenhouse.com/legal/subprocessorsHTTP 200 · 2026-10-13

Document changes

• medium 2026-10-13 · subprocessors +1 / −29 lines
  show diff

  + Last updated September 1, 2026. .

  − 10 Documents

  − SOC 1 Type II

  − SOC 2 Type II

  − GREENHOUSE SOFTWARE - ISO 42001:2023 CERTIFICATE

  − GREENHOUSE SOFTWARE - 2025 SOC 2 TYPE 2 - REPORT

  − Q2 2026 - GREENHOUSE RECRUITING PENTEST REPORT

  − Q3 2025 - GREENHOUSE ONBOARDING PENTEST REPORT

  − Q1 2026 - EXTERNAL NETWORK PENTEST CUSTOMER LETTER

  − GREENHOUSE SOFTWARE- ISO 27001 & 27701 CERTIFICATE

  − GREENHOUSE SOFTWARE - 2025 SOC 1 TYPE 2 - REPORT

  − GREENHOUSE SIG LITE

  − GREENHOUSE 2025 PCI-DSS SELF ASSESSMENT

  − CERTIFICATE OF CYBER INSURANCE 2025-2026

  − View all documents →

  − KNOWLEDGE BASE FAQS251
• high 2026-10-10 · privacy policy +47 / −42 lines
  show diff

  + Date last updated: October 1, 2026

  + Greenhouse Software, Inc. (“Greenhouse”) respects your privacy and is committed to protecting it in accordance with applicable laws and using generally-accepted industry practices. This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights. For purposes of this Privacy Policy, “Personal Information” means any information that is available to Greenhouse and that is protected explicitly by the European Union General Data Protection Regulation of 2016 (the “EU GDPR”); the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the “UK GDPR”); and the California Consumer Protection Act (“CCPA”), as amended by the California Privacy Rights Act of 2020, to the extent applicable.

  + Greenhouse is committed to the continual improvement of its Privacy Information Management System. We regularly review and update our privacy policies, procedures, and controls to reflect changes in applicable law, our products and services, and the results of our internal and external assessments.

  + Please note that Greenhouse is not a data broker, does not sell or share personal data of job candidates or individuals with whom it does not have a direct relationship, and is not subject to data broker laws or registries. Additionally, Greenhouse does not operate as a Consumer Reporting Agency (CRA) under the Fair Credit Reporting Act (FCRA).

  + Greenhouse is a leading provider of cloud-based software services that help companies manage and optimize their recruiting and hiring processes. Greenhouse processes personal data in four contexts, summarized below:

  + Does this Privacy Policy apply?

  + Customer Recruiting Data (Processor)

  + Candidate, applicant, and employee data Greenhouse processes on behalf of its recruiting/onboarding customers

  + No — governed by the customer’s own privacy policy and our Data Processing Addendum

  + Business Relationships (Controller)

  + Managing our commercial relationships with customers and vendors, including product usage data generated by their own users (e.g., recruiters, hiring managers)

  + Greenhouse Hiring (Controller)

  + Processing applications for jobs at Greenhouse itself

  + MyGreenhouse (Controller)

  + Data from individuals who create MyGreenhouse accounts to manage their job search

  + Customer Recruiting Data (Processor). As a processor on behalf of its customers for recruiting and onboarding purposes.

  + This Privacy Policy does not apply to Personal Information in this context. Our customers are the controllers of the Personal Information they collect through Greenhouse’s Services to manage their own recruiting and onboarding processes (e.g., names, contact information, and other data collected from prospects or from candidates as part of job applications), and each customer manages that Personal Information in accordance with its own privacy policies. Greenhouse’s privacy commitments to our customers are governed by a separate customer agreement that authorizes us to collect, process, and store Personal Information on their behalf, as a processor under the EU GDPR and the UK GDPR, and a service provider under the CCPA. Greenhouse processes Personal Information relating to our customers’ employees and job applicants within our Services only according to our customers’ instructions (as defined in our customer agreements), and we have no direct relationship with the individuals whose Personal Information we process solely as a processor on behalf of a customer. For example, if you apply to a job posted on a career page of a Greenhouse customer, your Personal Information will be automatically processed by Greenhouse on behalf of that customer. However, the company you applied to is the data controller (or business, as that term is defined in the CCPA) with respect to your Personal Information, and you should contact that entity directly with any questions you may have regarding its privacy policies or data processing practices, or if you wish to modify or access your Personal Information, restrict its processing, or delete it. Greenhouse’s customer contracts require us to redirect inquiries relating to the Personal Information we process on behalf of a customer back to that customer without taking any action on the request.

  + Business Relationships (Controller). As a controller in a commercial/B2B context (e.g., managing business relationships with customers and vendors).

  + Greenhouse Hiring (Controller). As a controller in an employment context (e.g., processing job applications for Greenhouse’s own hiring).

  + MyGreenhouse (Controller). As a controller for the MyGreenhouse service, where Personal Information is collected directly from individuals who choose to create MyGreenhouse accounts to manage their job search.

  + This Privacy Policy applies to Personal Information in the Business Relationships, Greenhouse Hiring, and MyGreenhouse contexts. Our websites, products and services are generally designed for businesses and their representatives. Outside of the MyGreenhouse service, we do not offer products or services for use by individuals for their personal, family or household purposes. Accordingly, we treat all Personal Information we collect, other than the Personal Information provided by users of the MyGreenhouse service, as pertaining to individuals in their capacities as business representatives and not as individual consumers. Greenhouse is the controller of Personal Information that we collect directly from visitors to our marketing website, www.greenhouse.com (the “Website”); from our own job applicants; and from our customers and vendors to help us manage our business relationships with them. This Privacy Policy describes the type of Personal Information that Greenhouse collects; Greenhouse’s policies around the use, disclosure, and retention of that Personal Information; and the choices available to you regarding your rights in relation to your Personal Information generally.

  + From your interaction with Sales, Marketing, and Customer Support We collect Personal Information such as your name, company name, email address, phone number, and billing information when you request a demo of our Services, or request sales information or customer service.

  + From your interaction with our products and services We collect information about how our products, services and features are being adopted and utilized. This may include information that is considered Personal Information by applicable law.

  + Third-party sources We may combine Personal Information we receive from you with personal information we obtain from other sources, such as:

  + Cookies, Scripts and Related Technologies When you visit our website, www.greenhouse.io, we and our third-party service providers receive Personal Information that you may have provided, such as your IP address. The technologies we use to track your movements around our website include cookies, tracking scripts and pixels, and tagging technologies, which we may employ to understand your preferences, improve your experience on our website, etc. You can control the use of cookies at the individual browser level. If you want to learn more about cookies, or how to control, disable, or delete them, please visit aboutcookies.org for detailed guidance.

  + Collection of Data by Advertisers We may also use third parties to manage our advertising on other sites. Certain third-party partners may automatically collect information about your visits to this and other websites, your IP address, your ISP, the browser you use to visit our website (but not your name, address, e-mail address or telephone number). They do this by using cookies, pixel tags or other technologies. Information collected may be used, among other things, to deliver advertising targeted to your interests and to better understand the usage and visitation of our website and the other sites tracked by these third parties. This policy does not apply to, and we are not responsible for, cookies or clear gifs in third party ads, and we encourage you to check the privacy policies of advertisers and/or ad services to learn about their use of cookies and other technology. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here: aboutads.info/choices or networkadvertising.org.

  + To process your job application to work at Greenhouse If we have collected your Personal Information in the Greenhouse Hiring context described above, for example, you applied for a job to work at Greenhouse and/or Greenhouse is considering you as a candidate for employment, Greenhouse will use the Personal Information provided in the context of your application for the purposes of processing and evaluating the application.

  + If we have collected your Personal Information in the Business Relationships context described above, we may use the information that we collect about you and from you, including Personal Information, for the following purposes:

  + HOW GREENHOUSE USES PRODUCT AND SERVICE USAGE DATA

  + Separately from the purposes described above, we collect and use information about how our products, services, and features are adopted and used — including by individuals at our business customers (such as recruiters and hiring managers using Greenhouse Recruiting, in the Business Relationships context) and by MyGreenhouse users — to analyze, maintain, and improve our products and services. Usage and analytics data generated by MyGreenhouse users is addressed further in the MyGreenhouse section below.

  − Date last updated: May 28, 2026

  − Greenhouse Software, Inc. ("Greenhouse") respects your privacy and is committed to protecting it in accordance with applicable laws and using generally-accepted industry practices. This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights. For purposes of this Privacy Policy, “Personal Information” means any information that is available to Greenhouse and that is protected explicitly by the European Union General Data Protection Regulation of 2016 (the “EU GDPR”); the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (the "UK GDPR"); and the California Consumer Protection Act (“CCPA”), as amended by the California Privacy Rights Act of 2020, to the extent applicable.

  − Please note that Greenhouse is not a data broker, does not sell or share personal data of job candidates or individuals with whom it does not have a direct relationship, and is not subject to data broker laws or registries.

  − Greenhouse is a leading provider of cloud-based software services that help companies manage and optimize their recruiting and hiring processes.

  − Greenhouse processes personal data in the following contexts:

  − 1. As a processor on behalf of its customers for recruiting and onboarding purposes.

  − This Privacy Policy does not apply to Personal Information in this context. Our customers are the controllers of the Personal Information they collect through Greenhouse’s Services to manage their own recruiting and onboarding processes (e.g., names, contact information, and other data collected as part of job applications), and each customer manages that Personal Information in accordance with its own privacy policies. Greenhouse’s privacy commitments to our customers are governed by a separate customer agreement that authorizes us to collect, process, and store Personal Information on their behalf, as a processor under the EU GDPR and the UK GDPR, and a service provider under the CCPA. Greenhouse processes Personal Information relating to our customers’ employees and job applicants within our Services only according to our customers’ instructions (as defined in our customer agreements), and we have no direct relationship with the individuals whose Personal Information we process in connection with our customers’ use of our Services. For example, if you apply to a job posted on a career page of a Greenhouse customer, your Personal Information will be automatically processed by Greenhouse on behalf of that customer. However, the company you applied to is the data controller (or business, as that term is defined in the CCPA) with respect to your Personal Information, and you should contact that entity directly with any questions you may have regarding its privacy policies or data processing practices, or if you wish to modify or access your Personal Information, restrict its processing, or delete it. Greenhouse’s customer contracts require us to redirect inquiries relating to the Personal Information we process on behalf of a customer back to that customer without taking any action on the request.

  − 2. As a controller in a commercial/B2B context (e.g., managing business relationships with customers and vendors).

  − 3. As a controller in an employment context (e.g., processing job applications for Greenhouse’s own hiring).

  − 4. As a controller for the MyGreenhouse service, where Personal Information is collected directly from individuals who choose to create MyGreenhouse accounts manage their job search.

  − This Privacy Policy applies to Personal Information in contexts 2, 3, and 4.

  − Our websites, products and services are generally designed for businesses and their representatives. Outside of the MyGreenhouse service, we do not offer products or services for use by individuals for their personal, family or household purposes. Accordingly, we treat all Personal Information we collect, other than the Personal Information provided by users of the MyGreenhouse service, as pertaining to individuals in their capacities as business representatives and not as individual consumers.

  − Greenhouse is the controller of Personal Information that we collect directly from visitors to our marketing website, www.greenhouse.com (the “Website”); from our own job applicants; and from our customers and vendors to help us manage our business relationships with them. This Privacy Policy describes the type of Personal Information that Greenhouse collects; Greenhouse’s policies around the use, disclosure, and retention of that Personal Information; and the choices available to you regarding your rights in relation to your Personal Information generally.

  − From your interaction with Sales, Marketing, and Customer Support

  − We collect Personal Information such as your name, company name, email address, phone number, and billing information when you request a demo of our Services, or request sales information or customer service.
• medium 2026-09-11 · subprocessors +3 / −1 lines
  show diff

  + KNOWLEDGE BASE FAQS251

  + Network Security

  + Secure Development

  − KNOWLEDGE BASE FAQS253
• medium 2026-09-09 · subprocessors +1 / −1 lines
  show diff

  + KNOWLEDGE BASE FAQS253

  − KNOWLEDGE BASE FAQS184

Fact changes

No changes recorded yet. Changes appear here when a later reading differs from an earlier one.

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.