Security and the AI Act.

• Human oversight (Articles 14 and 26): the AI only recommends. A recruiter decides on each candidate individually, can see the quotes, the transcript and the recording, and writes their own reason for every rejection. There is no bulk rejection by score.
• No emotion recognition (Article 5): only the content of the answers is assessed, never appearance, voice, facial expressions or emotions.
• Transparency (Article 50): before the interview starts, the candidate knows that they are talking to an AI, what is assessed and how long the data is retained. We store each consent together with the version of its text.
• Standardisation and evidence: the interview structure, the time limits and the task parameters are set by code, not by the model. A score without a verbatim quote from the transcript is not shown.
• The company approves the criteria: the AI only drafts the competency rubric from the job ad. A recruiter edits and approves it.
• Traceability (Article 12): for every interview plan and assessment, we record which model and which prompt version produced it, so that it is possible to show afterwards how a recommendation was reached. Sensitive actions (creation, consents, assessments, decisions, deletion) are written to the audit log.
• Reasonable adjustments: the candidate can request extended time, written answers or an interview with a person, and the recruiter is notified.

• Data stored in the EU: the application and our AI service run in data centres in Frankfurt, and the database and the storage for files and interview recordings are in the EU. Speech-to-text (Deepgram) uses a European endpoint. The language model (Anthropic) and the assistant’s voice (ElevenLabs) process data in the US with safeguards under the GDPR. See the list of sub-processors.
• Encryption: all communication uses HTTPS (HSTS), and data in the database and in storage is encrypted at rest.
• Separation between companies: every record belongs to one company, and every query is restricted to that company, including queries through the API.
• Data minimisation: the company chooses the recording mode (video, audio only or transcript only).
• Deletion: candidate data is deleted automatically after the retention period set by the company (30-730 days), or sooner, manually in the app or through the API.

• Log in with a link sent by email (no passwords to guess), with a limited number of attempts.
• Roles: Owner, Admin and Recruiter. Settings, the team and webhooks are available to admins only.
• A candidate’s invitation is a random 256-bit link, and only its hash is stored in the database. It is valid for 7 days. The candidate gets access to the interview room only after giving consent, only for 30 minutes and only to their own room.
• Recordings and CVs are opened through short-lived signed links, available only to members of the company.
• API keys belong to the company and are stored only as a hash. We sign webhooks with HMAC-SHA256 and a timestamp.
• Browser security settings (embedding in other websites is blocked, and URLs are protected from leaking).

We enter into a data processing agreement (Article 28 GDPR) with every company, including a list of sub-processors. A description of the processing is in our privacy policy, and information for candidates is on the For candidates page.

Have you found a security issue? Please email us at info@hireup.cz before you make it public. We will get back to you within two working days.