Security and candidate data
You are putting other people's personal data into this. Here is how it is handled.
HireIQ processes candidate data — CVs, interview transcripts and assessments — as a data processor on behalf of your organisation. Data is encrypted in transit and at rest, access is scoped to your team, candidate records can be deleted on request, and your data is not used to train AI models.
The basics
- Encryption in transit (TLS) and at rest
- Access control — your data is visible to your team only, scoped by role
- Authentication with password policy enforcement; SAML SSO on Enterprise
- No model training on your candidate data
- Deletion of candidate records on request, supporting GDPR erasure obligations
AI processing
CVs and interview transcripts are processed by large language models to produce analysis, questions and interviewer feedback. This is worth being precise about with your own DPO: it is a processing activity, it involves a sub-processor, and for employment decisions in the EU it sits inside a regulated area. Our data policy sets out the detail, and AI in hiring: what is legal in the EU and UK covers the obligations that fall on you as the employer.
What to ask any AI hiring vendor
Useful regardless of whether you choose us:
- Is our candidate data used to train your models, or anyone else's?
- Which sub-processors touch candidate data, and where are they?
- Can you delete an individual candidate on request, and how quickly?
- What is the retention default, and can we change it?
- Does the system make or automate any rejection decision without a human?
- What documentation can you give us for an EU AI Act assessment?
HireIQ produces analysis for humans to act on. It does not automatically reject candidates — a deliberate design decision, and one worth confirming with any vendor you evaluate.
Common questions
Where is candidate data stored?
On managed cloud infrastructure with encryption in transit and at rest. Contact us for the current region and sub-processor details for your contract.
Do you train AI models on our candidate data?
No. Your candidate data is used to provide the service to you.
Can we delete a candidate's data?
Yes. Candidate records can be deleted, which is what GDPR erasure requests require. See our data policy.
Do you support SSO?
SAML SSO is available on the Enterprise plan.