GDPR — how aiKip protects your data

aiKip is built in compliance with the General Data Protection Regulation (GDPR, EU 2016/679). This page summarizes the technical and organizational measures in place.

Sovereign hosting

All data (PostgreSQL database, CVs, PDF invoices) is hosted at Scaleway in the fr-par region (Paris, France). Scaleway is a French company not subject to the US CLOUD Act.

Technical measures

  • TLS 1.3 encrypted connections on all pages
  • Passwords hashed with bcrypt (12 rounds, unique salt per user)
  • HttpOnly, SameSite=Lax, Secure session cookies in production
  • Global session invalidation available (users.lastLogoutAt field)
  • Rate limiting on sign-up, login, password reset and the application form
  • Short-TTL pre-signed URLs (5 min) for CV downloads
  • Strict multi-tenancy: every query filters by companyId

Automatic anonymization

Applications inactive for more than 24 months are anonymized automatically every night:

  • Deletion of identity, contact details, profile photo, CV and extracted career history
  • Deletion of cover letters, screening answers, messages, notes and interview content
  • Removal of AI scores, summaries, strengths, warnings and assessment content
  • Only non-identifying pipeline statistics (stage and dates) are retained

This anonymization runs via the gdpr-cleanup cron, with no manual action.

Your rights

In line with the GDPR, you have a right of access, rectification, erasure, portability, objection and withdrawal of consent. To exercise them:

  • Candidate: use your tracking link received by email, or write to contact@aikip.fr
  • Recruiter: from your space or by email to contact@aikip.fr

A reply is provided within 30 days maximum.

You can also, at any time, lodge a complaint with the CNIL (www.cnil.fr).

Accountability

As a processor acting on behalf of client companies, aiKip keeps the register of processing activities carried out on their behalf (art. 30.2 GDPR) and assists each client — the controller — with data protection impact assessments and security (arts. 32 to 36 GDPR). A public Data Processing Agreement forms part of every subscription.

Recruiter account deletion

Voluntary account deletion and the end of a subscription both provide a 30-day window. After subscription end, the workspace is read-only and exports stay available; voluntary deletion can be canceled during its grace period. On expiry, operational data is erased or anonymized. Invoice records are first isolated and retained for ten years solely for accounting obligations.

Breach notification

For candidate data, aiKip acts as processor: it informs the client controller without undue delay and provides the information needed for the controller's assessment and notifications. For data for which aiKip is controller, aiKip notifies the CNIL within 72 hours where the breach is likely to create a risk, and affected individuals without undue delay where the risk is high.

GDPR contact

For any question about the processing of your data: contact@aikip.fr or via the contact form.