Security and privacy
1 Min. Lesezeit
CV-Transformer processes your candidates' personal data on your behalf, under the GDPR. This page summarizes how it is protected and what you control. The Privacy Policy and our Data Processing Agreement have the full details.
Where data is stored
CV-Transformer runs on servers in Frankfurt, Germany: the application, the database, file storage and sign-in. Data is encrypted in transit and at rest. The database is backed up daily; backups are encrypted and kept for seven days.
AI
The default AI model, Mistral Codestral, is configured not to use your data for training.
We don't use your candidates' data to train AI models.
When you choose another model under Settings → General, candidate data goes to that model's provider, which may be outside the EU. See Organization settings.
What you control
Retention: candidates are deleted automatically after 90 days by default. Change this under Settings → Candidates. See Retention and deletion.
Access: give each member only the permissions they need. See Team and permissions.
Multi-factor authentication: require it for every member under Settings → General.
Anonymization: share proposals without personal details. See Anonymization.
Links: anyone with a proposal's weblink can open it. Reset a candidate's weblinks to revoke every link you shared. See Sharing proposals.
Support access: our support team can look into your organization to help you, unless you turn this off under Settings → General.
API access: limit API keys and connected apps to the scopes they need, and revoke them when they're no longer used. See API keys.
Audit log
Every change to candidates, layouts, members and settings is logged with who made it, under Settings → Logs. See Logs.
Inactive organizations
When nobody has used an organization for two years, we email its administrators, and delete it 30 days later unless someone chooses to keep it.
Questions
For security or privacy questions, or to request our Data Processing Agreement, email privacy@cv-transformer.com.