This Agreement supplements the Terms of Service between Provider ("Processor") and the customer ("Controller"), and governs Processor's processing of personal data on Controller's behalf.
The Processor entity, governing law and jurisdiction, and whether this is a standalone agreement or an annex to the Terms, are to be completed.
Controller determines the purposes and means of processing candidate and recruiter personal data. Processor processes it only on Controller's documented instructions.
Processor acts as an independent controller for a narrow, separable set: account administration, billing, and security telemetry about Controller's own users. That data is not candidate data. The exact boundary of this carve-out is to be confirmed.
Candidates and applicants; Controller's own personnel (recruiters, hiring managers, administrators); contacts at Controller's client organisations; and — where Controller enables sourcing — individuals whose public professional profiles are retrieved from third-party sources and who have not applied.
Identity and contact details; CV and résumé content, including free text supplied by the data subject; employment and education history; skills and certifications; application and pipeline status; recruiter assessments, notes and interview scorecards; email and message content within connected threads; calendar entries for interviews; automated match scores and their explanations; and authentication data for Controller's own users.
Processor does not require special-category data. Two classes may nevertheless be present, and both are isolated by design:
Whether a data protection impact assessment is a precondition to offering either module is to be confirmed with counsel.
Processor processes personal data only on Controller's documented instructions, which comprise this Agreement, the Terms of Service, and Controller's own configuration of the service — including which integrations and sub-processors it enables. Processor informs Controller if an instruction appears to infringe applicable data-protection law.
Personnel authorised to process personal data are bound by confidentiality obligations. The specific obligation relied on is to be referenced.
Processor implements the measures in Annex A below. Annex A describes controls that exist in the software. It is not an audit result and asserts no certification.
Controller gives general written authorisation for Processor to engage sub-processors. The current register is published at /legal/subprocessors.
Most sub-processors are engaged only if Controller configures them. A deployment with no third-party credentials configured engages none of the optional processors and runs entirely on local fallbacks.
Processor gives Controller notice before adding or replacing a sub-processor that processes candidate data, and Controller may object on reasonable data-protection grounds. The notice period, the objection and escalation mechanism, and the channel notice is given on are to be completed.
Processor assists Controller in responding to data-subject requests. The service provides:
On termination, Controller may export its data through the service. Processor then deletes it, except where retention is required by law. The deletion window, and the separate period after which backups expire on their own schedule, are to be completed — and depend on the section 8 limitations being resolved first.
Processor makes available the information necessary to demonstrate compliance, and allows audits at reasonable frequency and on reasonable notice. Frequency, notice, cost allocation, and whether a third-party report may substitute, are to be completed.
No SOC 2 or ISO 27001 audit has been performed, and none is referenced anywhere in this agreement.
The transfer position depends on the hosting region and the configured sub-processors, several of which are US-headquartered. The transfer mechanism, the transfer impact assessment, and any applicable addendum are to be completed.
Processor notifies Controller without undue delay after becoming aware of a personal-data breach, with the information available at the time. The notification deadline, contact channel and content are to be completed.
Caps, carve-outs and indemnities are to be completed, and must align with the Terms of Service.
Descriptive of the software as it is today. Each item is a control that exists, not a plan; where a control depends on how a deployment is configured, that is stated.
Every customer workspace is isolated three independent ways: application-level query filters, database row-level security enforced on every workspace-owned table, and per-record ownership checks. The application connects as a database role that is not a superuser, cannot bypass row-level security, and does not own the schema — and it refuses to start outside development if that is not true. A test derived from the data model asserts that every workspace-owned table carries an active policy, and it runs against a real database.
Role-based access with per-record ownership. Four separate authentication boundaries — internal staff, API keys, employer-portal contacts and candidate-portal users — none of which can satisfy another. Optional enforced two-factor authentication per workspace. Account lockout after repeated failures. API keys are stored only as a hash, are scoped to specific operations, and act as a named person rather than as the workspace.
Append-only and tamper-evident: every entry carries a chained SHA-256 hash. Updates are revoked at the database and blocked by trigger, and deletion requires an explicit session opt-in used by three named code paths. A scheduled verifier walks every chain and publishes the head hash, so truncation is detectable.
Configurable retention for activity records, notifications, message threads, un-imported sourced profiles and sourcing decisions, each swept on its own schedule. Candidate data supplied by Controller is retained for the term, since Controller determines its retention.
The scoring model is name-blind and never receives protected-attribute data or work-authorisation status. Every automated score — including a score produced by the deterministic fallback when the model is unavailable — is recorded with the model, prompt version, inputs and rationale. Adverse-impact statistics suppress small groups and defend against recovering them by subtraction, and the report is prevented in code from ever concluding "no bias found".
Nullable-reference analysis; two automated test tiers, one of which runs against a real database under a least-privilege role; and structural tests that detect when a required security check is absent rather than merely wrong.
Processor does not assert any of these as a CI-enforced gate, and does not assert automated dependency-vulnerability gating or static analysis at all. All of those workflows exist in the repository, but as of 24 August 2026 every continuous-integration job was refused at start by an exhausted build-minutes budget and the default branch carries no protection rule requiring them — so "fails the build" would describe what the tests are written to do, not a control that was running. Annex A states only what is operating.