Data Processing & Security

1. Purpose of this document

This document describes how the Helen AI platform processes personal data, what security measures protect it, how the system is designed for human oversight, and where we stand against the EU AI Act and the GDPR.

It is written to be read alongside the Terms of Service, the Privacy Notice for Candidates, our Data Processing Agreement and the Sub-processor List.

2. Roles under two frameworks

Recruitment AI sits under both the GDPR and the AI Act, and the two use different vocabulary for different things. We map both.

As Processor we act only on the Customer's documented instructions and never determine the purposes of processing.

As Provider we are responsible for the design, risk management, technical documentation, logging, accuracy, robustness and cybersecurity of the system, and for the instructions for use we give the Deployer.

The Deployer is responsible for how the system is configured and used: the questions asked, the criteria applied, human oversight of outputs, informing candidates and worker representatives, and the lawfulness of the processing — including, where regulated-role vetting questions are enabled, the Article 9(2) condition and Article 10 authorisation described in section 5.

A Customer that white-labels the system, changes its intended purpose, or substantially modifies it may become a Provider under Article 25 and assume Provider obligations.

3. Regulatory classification

We classify Helen AI as a high-risk AI system under Annex III, point 4(a) of the AI Act — an AI system intended to be used for the recruitment or selection of natural persons, in particular to filter applications and evaluate candidates.

We do not claim the Article 6(3) derogation. The derogation is unavailable where a system performs profiling of natural persons, and we take the conservative view that structured candidate screening may do so. Vendors who argue their way out of this classification transfer risk to their customers rather than eliminating it.

3.1 Applicable dates

The Digital Omnibus on AI was adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, entering into force in July 2026. It deferred the high-risk regime but left most transparency obligations in place.

3.2 A note on the deferral

The December 2027 date gives providers runway; it does not change the substance of the obligations. Our programme is scheduled against that date, not paused until it. Systems placed on the market before the deadline benefit from transitional treatment until substantially modified, and we track what would constitute a substantial modification to our system.

4. System architecture and data flow

4.1 Processing flow

• Invitation. The Customer invites a candidate. The candidate receives the AI disclosure and the Privacy Notice before starting.

• CV intake. The candidate uploads a CV. Text is extracted and stored with the candidate record.

• Qualifying questions. The candidate answers closed-form questions defined by the Customer.

• Advancement rule. The system applies the Customer's configured rule to determine whether the candidate is invited to the interview stage. This is deterministic rule evaluation against the Customer's stated criteria — not a model inference.

• AI interview. Invited candidates complete a structured interview following the Customer's fixed question sequence. The AI asks each question in order and may ask at most one clarifying follow-up per question. Audio and video are captured where recording is enabled; speech is transcribed.

• Storage. Recordings and transcripts are written to S3; the candidate record in PostgreSQL is updated with storage references. Interview text processed by the AI model provider is not retained by that provider (see §8).

• Dashboard. All candidates — advanced and not advanced — appear with CV, answers, status and, where applicable, recording and transcript.

4.3 Categories of data processed

5. Special category and criminal offence data

The platform supports two screening configurations, and this document describes both.

5.1 Standard screening (default)

Customers are contractually prohibited from configuring questions intended to elicit special category data (Article 9 GDPR) or criminal offence data (Article 10 GDPR). Because interviews are open-response, candidates may nevertheless volunteer such information; where this occurs, the Controller is responsible for identifying an appropriate condition for any further use or for disregarding it.

5.2 Regulated Role Screening

For roles subject to statutory vetting — principally licensed security work — the Customer may enable a configuration in which questions lawfully cover, to the extent necessary for the role:

This configuration may be used only where the Controller has documented: necessity and proportionality per category for the specific role; a valid Article 9(2) condition (typically explicit consent under Art. 9(2)(a), or employment-law necessity under Art. 9(2)(b) where national law provides); Article 10 authorisation for criminal data in each recruiting jurisdiction; a completed DPIA; candidate notice before any sensitive question is asked, with recorded explicit consent where consent is the condition; restricted internal access; and the shortest retention compatible with the vetting purpose. These conditions are contractual (Terms of Service, clause 9) and we may require evidence of them.

Heightened safeguards applied by us for this configuration: EU data residency for records and media; zero-retention AI processing; access restricted to named personnel with a documented operational need; priority handling of deletion requests.

A DPIA is required. Large-scale processing of special category data combined with AI-assisted evaluation of individuals places this processing squarely within Article 35(3) GDPR. We provide Controllers with the technical detail needed for their DPIA on request.

6. What the system does not do

This section is a statement of system design, not a policy aspiration.

Article 5(1)(f) prohibits AI systems inferring emotions in the workplace, and has been in force since 2 February 2025. The system contains no emotion-inference capability, and no configuration option can enable one.

Candidates in the dashboard appear in a defined display order. Order is not rank. No suitability value is computed, stored or exposed. Where optional assessments are enabled, results are produced by fixed, documented scoring keys and presented as informational outputs; they are not converted into a recommendation or ranking.

7. Automated processing and human oversight

7.1 What is automated

The advancement rule is automated. We describe it plainly rather than characterising it as something else.

7.2 Why it is not a solely automated decision under Article 22 GDPR

• Non-advancement is not rejection. The candidate record remains fully visible and actionable in the Customer's dashboard.

• The system issues no communication, rejection or adverse action to candidates.

• Every decision affecting a candidate is taken by a human at the Customer.

• Customers are contractually prohibited from wiring non-advancement to an automated rejection, in the Service or in any connected system.

7.3 Oversight designed into the product (AI Act Art. 14)

• Non-advanced candidates are displayed in the same view as advanced candidates, not hidden behind a filter or archived by default

• Reviewers can see exactly which criterion a candidate did or did not meet, and why the rule produced its result

• Reviewers can override the outcome and advance any candidate manually

• Transcripts are presented alongside the original recording, never as a substitute for it

• The interface avoids language implying assessment, scoring or recommendation

7.4 Human review requests

Candidate requests for human review received by us are forwarded to the Controller within 5 business days, logged, and confirmed to the candidate. The Controller is responsible for conducting the review.

8. Sub-processors and third-party AI

The complete, current list is maintained in our Legal Center and includes, for each entity: legal name, function, processing location, transfer mechanism, and the date added.

Change notification. Customers receive at least 30 days' notice of any addition or replacement, with a right to object on reasonable data protection grounds.

8.1 AI provider terms

For each AI provider we state the contractual position, because "zero retention where applicable" is not a commitment:

The contractual position stated above is kept current; any change is notified under our sub-processor change process.

9. Security measures

9.1 Encryption

• In transit: TLS on all external endpoints; real-time interview media over DTLS-SRTP (standard WebRTC encryption); TLS-encrypted connections to the database

• At rest: database storage encrypted at volume level; S3 objects protected with server-side encryption

9.2 Access control

• Role-based access on the principle of least privilege

• Multi-factor authentication required for administrative and production access

• Production access limited to named personnel with a documented operational need

• Access to candidate data is logged

• Records flagged under Regulated Role Screening (§5.2) are additionally restricted

9.3 Infrastructure

• Hosted with Amazon Web Services in the European Union

• Customer data is logically separated per tenant

• Development and testing environments are isolated from production candidate data

9.4 Development practices

• All production changes are code-reviewed

• Dependencies are monitored for known vulnerabilities and patched promptly

9.5 System logging (AI Act Art. 12 and 26(6))

The system automatically records events over its lifetime, including screening session records, configuration changes, advancement rule evaluations and overrides. Logs are retained for at least six months, or longer where the Customer's retention configuration or applicable law requires.

9.6 Personnel

All personnel and contractors are bound by confidentiality obligations and receive security and data protection training.

10. Retention and deletion

When a retention period expires, background jobs automatically purge the database records and issue deletion commands for the corresponding S3 objects. Deletion certificates are provided on request. On termination, Customers have 30 days to export before deletion under the DPA.

11. Incident response

• Detection and triage: systems are monitored for anomalies and failures

• Notification to Controllers: without undue delay and in any event within 48 hours of becoming aware of a personal data breach, giving Controllers time to meet their own 72-hour obligation under Article 33 GDPR

• Content of notification: nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken

• Serious incident reporting under AI Act Art. 73: a procedure is in place for reporting serious incidents to the relevant market surveillance authority within the applicable deadlines once Chapter III applies

• Post-incident: root cause analysis and a written report to affected Customers

• Security disclosure: [email protected]

12. Fairness, bias and accuracy

12.1 Design-level guarantees

Our approach to fairness rests on how the system is built, and we state it in those terms:

• The advancement rule is deterministic. It evaluates only the closed-form criteria the Customer has stated, and is structurally insensitive to name, gender, age markers, accent or any other attribute not contained in those criteria. There is no model inference in the advancement step.

• No suitability model exists in the system, so there is no learned scoring function in which bias could accumulate.

• Transcription limitations are published in §12.3, and the recording — not the transcript — is the authoritative record a reviewer sees.

The Digital Omnibus amended the GDPR to provide a clearer lawful route for processing special category data specifically for the purpose of bias detection and correction in AI systems. Where we conduct such testing, it is carried out on that basis, under documented safeguards, and never for any operational purpose affecting an individual candidate.

12.2 Customer-side audit obligations

Bias audit duties frequently fall on the employer or employment agency, not on us. Customers recruiting in the following jurisdictions should confirm their own position:

• New York City (Local Law 144): annual independent bias audit of automated employment decision tools, published summary of results, and advance notice to candidates

• Illinois (AI Video Interview Act): notice, explanation of how the AI works and what characteristics it evaluates, and consent before AI analysis of video interviews

• Maryland: consent required before facial recognition in interviews — not applicable to this system, as no facial analysis is performed

• Colorado AI Act: duties on developers and deployers of high-risk systems in consequential decisions, including employment

We support Customers with the documentation they need for their own audits, on request.

12.3 Known limitations

We publish these rather than omit them:

• Automatic speech recognition performs unevenly across accents, dialects, speech impairments and noisy environments. The browser-native voice route depends on the candidate's browser and device and varies accordingly. Recordings, not transcripts, are the authoritative record.

• The system does not verify the identity of candidates and does not detect impersonation or misrepresentation. Answers — including answers to regulated-role vetting questions — are self-reported and do not substitute for official background checks where the law requires them.

• Structured interviews may disadvantage candidates who are unfamiliar with the format or who lack a suitable device or private space. Alternative routes must be offered.

• Assessment instruments are validated on specific populations and in specific languages, stated per instrument in the dashboard documentation.

13. AI literacy support (Art. 4)

Article 4 has applied since February 2025 and places obligations on both Providers and Deployers. We provide Customers with: instructions for use, guidance on interpreting outputs and their limits, and training material for reviewers covering the Deployer obligations under Article 26.

14. Conformity programme

Chapter III of the AI Act applies to Annex III stand-alone high-risk systems from 2 December 2027. Our conformity programme is scheduled against that date and addresses each requirement: risk management (Art. 9), data and data governance (Art. 10), technical documentation (Art. 11), record-keeping and logging (Art. 12), transparency and instructions for use (Art. 13), human oversight design (Art. 14 — already implemented, see §7), accuracy, robustness and cybersecurity (Art. 15), the quality management system (Art. 17), conformity assessment and CE marking (Arts. 43, 48), and EU database registration (Arts. 49, 71).

Programme status is available to Customers on request.

14.1 Certifications

We do not currently hold independent certifications such as ISO/IEC 27001, ISO/IEC 42001 or SOC 2. Our cloud voice provider holds SOC 2 Type II. Certification forms part of our roadmap toward the December 2027 conformity deadline, and we answer security questionnaires and support Customer due diligence in the meantime.

15. Accessibility

Our accessibility statement — target conformance level WCAG 2.2 AA, testing method, known gaps and remediation timeline — is available on request, reflecting requirements under the European Accessibility Act.

Customers must offer an accessible alternative route through first-round screening on request, and must not treat such a request as an adverse signal.

16. Data protection governance

• Data Processing Agreement: available on request

• Records of processing (Art. 30): maintained; available to Customers on request

• Data Protection Impact Assessment: a DPIA is generally required of the Controller for recruitment AI, and always where Regulated Role Screening is enabled. We provide supporting technical detail on request.

• Transfer assessment: an assessment covering processing in the United States is maintained and available on request

• Data protection contact: we have not appointed a Data Protection Officer; the criteria of Article 37 GDPR are kept under review, particularly in relation to Regulated Role Screening at scale. The responsible contact is [email protected].

• EU representative: not required — we are established in the European Union (Latvia)

• Audit rights: as set out in the DPA. We support Customer audits through documentation, security questionnaires and, on reasonable notice, audits as provided in the DPA.