[Security and privacy](https://www.cv-transformer.com/nl/docs/security)

# Security and privacy

1 min lezen

CV-Transformer processes your candidates' personal data on your behalf, under the GDPR. This page summarizes how it is protected and what you control. The [Privacy Policy](https://www.cv-transformer.com/en/privacy) and our Data Processing Agreement have the full details.

## [Where data is stored](#where-data-is-stored)

CV-Transformer runs on servers in Frankfurt, Germany: the application, the database, file storage and sign-in. Data is encrypted in transit and at rest. The database is backed up daily; backups are encrypted and kept for seven days.

## [AI](#ai)

- The default AI model, Mistral Codestral, is configured not to use your data for training.
- We don't use your candidates' data to train AI models.
- When you choose another model under **Settings** → **General**, candidate data goes to that model's provider, which may be outside the EU. See [Organization settings](https://www.cv-transformer.com/en/docs/organization/settings#ai-model).

## [What you control](#what-you-control)

- **Retention**: candidates are deleted automatically after 90 days by default. Change this under **Settings** → **Candidates**. See [Retention and deletion](https://www.cv-transformer.com/en/docs/candidates/retention).
- **Access**: give each member only the permissions they need. See [Team and permissions](https://www.cv-transformer.com/en/docs/organization/team).
- **Multi-factor authentication**: require it for every member under **Settings** → **General**.
- **Anonymization**: share proposals without personal details. See [Anonymization](https://www.cv-transformer.com/en/docs/layouts/anonymization).
- **Links**: anyone with a proposal's weblink can open it. Reset a candidate's weblinks to revoke every link you shared. See [Sharing proposals](https://www.cv-transformer.com/en/docs/candidates/sharing#resetting-weblinks).
- **Support access**: our support team can look into your organization to help you, unless you turn this off under **Settings** → **General**.
- **API access**: limit API keys and connected apps to the scopes they need, and revoke them when they're no longer used. See [API keys](https://www.cv-transformer.com/en/docs/developers/api-keys).

## [Audit log](#audit-log)

Every change to candidates, layouts, members and settings is logged with who made it, under **Settings** → **Logs**. See [Logs](https://www.cv-transformer.com/en/docs/organization/logs).

## [Inactive organizations](#inactive-organizations)

When nobody has used an organization for two years, we email its administrators, and delete it 30 days later unless someone chooses to keep it.

## [Questions](#questions)

For security or privacy questions, or to request our Data Processing Agreement, email [privacy@cv-transformer.com](mailto:privacy@cv-transformer.com).

[VorigeConnected apps and OAuth](https://www.cv-transformer.com/nl/docs/developers/connected-apps) [VolgendeTroubleshooting](https://www.cv-transformer.com/nl/docs/troubleshooting)