Security & privacy
Fair hiring needs
careful data.
Candidate CVs are some of the most sensitive data an HR team handles. We treat them that way: stored in the EU, encrypted, explainable, and deletable on request.
Data stays in the EU
Candidate data is stored and processed on infrastructure in the European Union. It is never sold, and never used to train shared models.
Encrypted in transit & at rest
Every connection uses TLS, and stored data is encrypted at rest. Access is scoped to your organization and logged.
Bias-aware by design
Optional blind screening removes names, photos, ages and schools during the first pass, so your shortlist starts on relevant evidence.
A full audit trail
Every ranking and every 'set aside' keeps its reason. You can answer 'why was this candidate not shortlisted?' in one click.
Access you control
Invite reviewers, scope who sees what, and remove access instantly. Enterprise plans add SSO and detailed audit logs.
Deletion, honoured
Retention is configurable and deletion requests are honoured automatically. When a candidate or role is removed, it is gone.
How we handle candidate data
When you upload applications, Zen Job CV reads each CV, standardizes it, and applies the filters you set. That processing is the whole point of the product, and under the GDPR it is done on your instruction as the data controller. We act as your processor and only use candidate data to run the screening you asked for.
- We do not sell candidate data, and we do not use it to train models shared with anyone else.
- We collect the minimum needed to screen: the CV, your filters, and the reviewer notes you add.
- Data is stored and processed within the EU.
Bias-aware screening is a first-class feature
Fairness is not a policy page here, it is a switch. Optional blind screening hides names, photos, ages and schools during the first pass, so early decisions rest on skills and experience. This matters because the evidence is clear that identity signals change outcomes: otherwise identical CVs receive different callback rates based on the name alone. Blinding removes that channel where it does the most damage, the fast high-volume first pass. We also keep the ranking itself explainable, because anonymizing a CV and then scoring it in a black box is not fair screening.
Explainability and the EU AI Act
Screening software used in recruitment is treated as high-risk under the EU AI Act, which expects transparency and human oversight. Zen Job CV is built for exactly that: every candidate carries the reasons behind their ranking, near-misses are surfaced rather than dropped, and the final hiring decision always stays with your team. We assist judgement, we do not replace it.
Your rights, and your candidates'
Data-subject requests are part of hiring. Zen Job CV makes them practical:
- Access and export: see everything held about a candidate or role.
- Correction: fix or re-screen when information changes.
- Erasure: deletion requests are honoured automatically, and retention windows are configurable per role.
Candidates you filter out are never silently deleted. They stay in a "set aside" list with the reason attached, so you can rescue anyone, send kind rejections, or remove them for good, on your terms.
Data processing agreement
We sign a Data Processing Agreement (DPA) on all paid plans, covering the roles, security measures, sub-processors, and international-transfer safeguards required by the GDPR. Need the DPA before you start? Email [email protected] and we will send it over.
An honest note on certifications
We describe the practices we actually follow rather than badges we have not earned. If your procurement process needs a specific certification, questionnaire, or security review, write to us and we will tell you plainly where we stand and what is on the roadmap.
Questions from your security team?
We answer them plainly, and a human replies within a day. Bring your questionnaire.