So to be clear, you only contact references that the candidate provided to you and not others such as connections on LinkedIn? Your answer doesn't seem to specifically deny that you contact people not specifically provided, other than employers.
By the way I read a little on your job site and Zapier sounds like a great place to work :-)