GDPR compliance and security
Everything your DPO needs to know before signing
CVpass is built to pass the due diligence of a DPO (Data Protection Officer) at a public school or a consulting firm. EU hosting, signable DPA, anonymisation after 6 months, strict separation by organisation. Full documentation below.
Six concrete commitments
Hosting in the European Union
Database and file storage hosted on Supabase (Frankfurt region, Germany). No customer data outside the EU for primary storage.
Signable Article 28 DPA
Data processing agreement compliant with GDPR Article 28, accepted by default when you subscribe to a B2B plan. A bilaterally signed version is available on request.
Anonymisation after 6 months
Uploaded CVs and job postings are deleted or anonymised after 6 months of inactivity. Technical data 30 days after termination. A strict policy by default.
Separation by organisation
Each client organisation has its own org_id. No cross-visibility between organisations. Row Level Security policy at the database level.
End-to-end encryption
TLS 1.2+ in transit, AES-256 at rest on the database. SSL certificates renewed automatically. Encrypted backups with 7-day retention.
AI that never trains on your data
We use the OpenAI API: the data sent is not used to train the models, and OpenAI keeps it for 30 days maximum (abuse monitoring) before deleting it.
Subprocessors and purposes
Complete list of subprocessors and their purposes. Any change is notified by email with 30 days' notice.
| Subprocessor | Region |
|---|---|
| Vercel Inc. | United States (DPF) |
| Supabase Inc. | Germany (EU) |
| Clerk Inc. | United States (DPF) |
| OpenAI, LLC | United States (DPF) |
| Stripe Inc. | United States / Ireland |
| Brevo (Sendinblue) | France (EU) |
Data subject rights
CVpass provides the data controller with the tools needed to respond to requests from data subjects. Requests received directly by CVpass are forwarded within 5 business days.
- Right of access to data
- Right to rectification
- Right to erasure
- Right to data portability
- Right to object
- Right to restriction of processing
FAQ
Top questions from DPOs
Answers to the 5 questions data protection officers ask us first during a pre-signature audit.
Where is the data stored? Does it stay in the European Union?
Primary data (CVs, job postings, usage metadata, organisations, members) is stored on Supabase, Frankfurt region (Germany, EU). No replication outside the EU. The only transfers to the United States involve subprocessors (Vercel for front-end hosting, Clerk for authentication, OpenAI for AI), all certified under the DPF (Data Privacy Framework), with SCCs (Standard Contractual Clauses) in addition.
Can the DPA be signed by both parties, or is it imposed as is?
Both options are available. The DPA is tacitly accepted when you subscribe to a B2B plan (text shown at /b2b/dpa). For organisations that request a bilateral signature, write to legal@cvpass.fr: we send back a PDF within 48 business hours, which you can sign via DocuSign or on paper, depending on your requirements.
What is the anonymisation policy after the contract ends?
Technical data (logs, metadata) is deleted within 30 days of termination. Uploaded CVs and job postings are deleted within 90 days. Automatic anonymisation after 6 months of inactivity, even for active subscriptions (CVs are not kept indefinitely). Invoices are kept for 10 years to meet French accounting obligations.
What does OpenAI do with our data when the AI analyses a CV?
It does not use it to train its models. Under the OpenAI API terms, the data sent is kept for 30 days maximum for abuse monitoring, then deleted. This is documented in our Article 28 DPA.
What is the notification deadline in the event of a data breach?
48 hours maximum after becoming aware of it, by email to the designated contacts in the client organisation, in accordance with Article 33 of the GDPR. The CVpass DPO (dpo@cvpass.fr) coordinates the procedure, including notification to the CNIL (the French data protection authority) if necessary.
A specific GDPR question?
Our Data Protection Officer replies within 48 business hours. An annual documentation audit is available for clients under contract.