GDPR & Data Privacy FAQ

No. The API operates on a zero-storage architecture. When you send a resume PDF to the /v1/parse endpoint, the file is held in memory only for the duration of processing (typically under 8 seconds for a single page). Once the parsed JSON response is returned to you, the original file and all derived data are immediately discarded from memory. Nothing is written to disk, no copies are cached, and no logs contain resume content. This means there is no data to delete later because nothing is retained in the first place. For the /v1/upload flow, the parsed results are temporarily available via /v1/upload-results and are purged automatically after retrieval.

All API processing happens on servers located in Helsinki, Finland, within the European Union. This means resume data never leaves the EU during processing, which simplifies GDPR compliance for European organizations and satisfies data residency requirements that prohibit transferring personal data to non-EU countries. The Helsinki data center uses enterprise-grade physical security and is operated by a certified cloud infrastructure provider. If your organization requires processing in a specific country or on your own infrastructure, see our self-hosted Docker deployment option.

Yes. The API is designed to support GDPR compliance through several architectural decisions: zero data storage (no personal data is retained after processing), EU-only processing (Helsinki servers), encryption in transit (TLS 1.2+), and no sub-processor data sharing (resume content is never sent to third parties). As the data controller, your organization remains responsible for having a lawful basis to process candidate resumes (typically legitimate interest or consent) and for informing candidates about your data processing activities. We can provide a Data Processing Agreement (DPA) upon request to formalize the controller-processor relationship.

All communication with the API is encrypted using HTTPS with TLS 1.2 or higher. This means the resume file you upload and the parsed JSON response you receive are encrypted end-to-end between your server and our API endpoint. No data travels in plaintext at any point. The TLS certificates are managed and rotated automatically. We enforce HTTPS-only connections; the API does not accept unencrypted HTTP requests. If your organization requires specific cipher suites or TLS versions, contact us to discuss configuration options.

Yes. We offer a self-hosted deployment option packaged as a Docker container that runs entirely on your own infrastructure. With self-hosting, resume data never leaves your network because the parser runs locally. This option is ideal for organizations in regulated industries (healthcare, finance, government) that cannot send personal data to external APIs under any circumstances. The Docker image includes the same AI models and achieves the same 99.2% accuracy as the cloud API. Contact us for licensing details, hardware requirements, and deployment documentation.

Yes. Because all processing occurs on EU-based servers in Helsinki and no data is stored after processing, the API is well-suited for handling EU candidate data under GDPR. You do not need to worry about cross-border data transfers or adequacy decisions because the data stays within the EU throughout the entire processing lifecycle. Ensure that your own application stores parsed results in a GDPR-compliant manner, including having appropriate data retention policies, honoring data subject access requests, and maintaining records of processing activities as required by Articles 30 and 15 of the GDPR.

No. Resume content is never shared with third parties, used for model training, or analyzed for any purpose beyond fulfilling your parsing request. We do not use sub-processors for the parsing itself. The only data we retain is API usage metadata (request timestamps, response status codes, processing duration) for operational monitoring and billing. This metadata contains no personal information from the resume. Our privacy architecture ensures that your candidates' personal data is processed exclusively to return the parsed result to you and for no other purpose.

Our infrastructure is hosted on a certified cloud platform in Helsinki with ISO 27001-aligned security practices. We conduct regular security reviews of the API codebase and infrastructure configuration. The zero-storage architecture significantly reduces the attack surface because there is no database of personal data that could be breached. We enforce TLS 1.2+ for all connections, rotate credentials regularly, and monitor for unauthorized access attempts. For organizations with specific compliance requirements, we can provide detailed security documentation and discuss custom arrangements including penetration test reports upon request under NDA.