Week29 processes candidate data as a data processor, inside the EU, with the person still in the decision. Here is what that looks like in practice.
Candidate data, CV text and vectors sit in our own database in Frankfurt, in a separate database per customer. Search vectors are computed in our own service, without the text being sent to any model provider. The language models are called through Amazon Bedrock and run in AWS data centres inside the EU, so those calls stay inside the EU as well.
You own the candidate data. We process it on your documented instructions under a data processing agreement, and delete it when the engagement ends. Our sub-processors for the service are Render, for hosting and storage in Frankfurt, and Amazon Web Services, for the language model calls inside the EU.
Your Teamtailor key is encrypted at rest and can never be read out through the panel or any API. Permissions come in two levels, so the person who administers the key and the settings can be separated from the person who works in the panel.
Every run and action is logged in an event log without personal data, so the processing can be audited afterwards.
Four steps, and a person at the end of each.
Candidates are fetched with your own key, which you connect yourself and can disconnect.
Text and vectors are stored in Frankfurt, in a separate database per customer. Candidate text is stripped of hidden characters before it is used, and text that looks like instructions to an AI is flagged for review.
The ranking is computed with fixed rules over stored data, and the same input gives the same result. Titles and employers are read out of the CV once with a language model.
The recruiter judges, selects and confirms. Nothing is sent from the panel to Teamtailor without a human click. If you run the connection through the Teamtailor marketplace, the match level is written back in the way you activated it.
We do not claim full regulatory compliance and we are not ISO 27001 certified. We show the documentation per processing activity and say what is in place and what is on the way. If you want to go deep into the architecture, we do that in a demo.
We show the ranking, the evidence and the controls, and answer the questions about data and regulation. It takes thirty minutes.