What your CIO and DPO will check. It is all here.
RecrutIA processes candidate data on behalf of recruitment agencies. Here, without jargon, is how it is hosted, protected and purged, and how the platform complies with the GDPR and the EU AI Act.
Platform security
Hosted in the European Union
Application and database hosted in Frankfurt (Germany) with Render, daily backups kept for 7 days in the same region, plus an encrypted off-site copy (Scaleway, Paris). AI processing is entrusted to the sub-processors listed below, including US providers, under the DPA.
Encryption in transit and at rest
TLS 1.2 minimum in transit, 1-year preloaded HSTS. At rest: ATS integration keys, two-factor secrets and off-site backup copies encrypted with AES-256-GCM; passwords hashed with bcrypt. The server accesses content to process it: this is not end-to-end encryption.
Strict content security policy
Every page is served with a unique token: only signed scripts run, no inline handlers, no third-party resources apart from fonts. Protection against script injection and clickjacking (frame-ancestors none).
Isolation between agencies
Every request is filtered by the agency identifier. An agency can neither read, modify nor delete another agency's data: verified by 16 cross-access tests at every audit.
Authentication and sessions
Passwords of 8 characters minimum, lockout after 8 attempts in 15 minutes, HttpOnly, Secure and SameSite session cookie, 7-day expiry, immediate invalidation at logout. Admin and member roles. Two-factor authentication (TOTP, backup codes) available to every user and enforceable for the whole team.
Logging and audits
Every AI action and every decision is logged (who, what, when, which engine). The site is audited automatically: 34 security checks and 343 functional checks in 7 languages at every release.
GDPR and AI Act
Minimisation and automatic purge
CV texts and referee answers are purged automatically after the retention period chosen by the agency: 30 days by default, 90 maximum. Summaries remain available.
Pseudonymised scoring (art. 10)
Name, email, phone, age, date of birth, family status and nationality are masked before anything is sent to the AI. Titles, gendered wording and the address may remain in the CV text: masking reduces the risk of bias, it does not remove it. Identity is re-attached locally, never transmitted to the model.
Human oversight, made demonstrable (art. 14)
The final decision is always human. By design, any decision contradicting the AI's opinion requires a justification, recorded with author and date in the register. Article 14 requires effective human oversight; this systematic justification is our way of making it demonstrable.
Explanation to the candidate (art. 86)
Every rejected candidate can obtain, in one click, an explanation sheet of the AI-assisted decision, written in their language, free of discriminatory content.
Processing register (art. 26)
CSV-exportable register of every AI-assisted decision: score, verdict, engine, pseudonymisation, human decision, justification. The document an auditor will ask for.
Rights of individuals
Permanent erasure of a candidate or a reference in one click, CSV export, complete deletion of the workspace by the agency administrator. The referee gives explicit consent before answering.
Sub-processors
| Provider | Role | Location and safeguards |
|---|---|---|
| Render Services, Inc. | Hosting of the application, database and backups | Frankfurt, Germany (EU) |
| Anthropic | Primary AI engine (CV analysis, files, references, summaries) | United States — data can be pseudonymised through pseudonymised scoring; transfers governed by contract (see DPA); no use for training |
| OpenAI | Fallback AI engine (Pro plan only, if the primary engine is unavailable) | United States — same safeguards |
| Stripe | Subscription payments (card, SEPA), invoicing | PCI-DSS certified; RecrutIA stores no banking data |
| Resend | Transactional emails (welcome, reference requests) | United States — content limited to the strict minimum |
This list is reproduced in the DPA. Any change is notified to client agencies. No advertising cookie or third-party tracker is used on the site.
Documents and verification
Security question, vulnerability report or request from your DPO: contact@recrutia-ai.com — reply within 2 business days.