Security & Compliance

Paste a resume and the job description to get a structured fit scorecard: strengths, gaps, and the evidence behind each call.

What we handle

CandidateScore processes resumes, CVs, and job descriptions you submit. These inputs often contain personal data and may include special-category data (GDPR Art.9) if present in free-text. We do not train public models on your submissions without explicit consent (GDPR Art.6).

Data handling commitments

Lawful basis & minimization — input is used only to generate your result; we minimize retained data (GDPR Art.5, Art.17 erasure).
No prohibited inference — we do not score on protected characteristics; output is built from role-relevant, auditable signals.
Encryption in transit & at rest via standard TLS / encrypted storage (GDPR Art.32).
Least-privilege access; no resale of candidate data to third parties.

Compliance posture

B2B data-processor posture: you (employer / recruiter) remain the data controller and are responsible for the lawful basis of processing candidate data. CandidateScore is decision-support, not a substitute for human review or legal sign-off.

Honesty note: CandidateScore does not guarantee compliance, 100% coverage, bias-free output, or that you will never miss a requirement. Treat every scorecard as decision-support, not legal or hiring sign-off. We do not claim certifications we have not obtained.

Subprocessors

We rely on our hosting provider (Vercel) and payment processor (Waffo). A current subprocessor list is available on request. No data is sold.