Trust Centre

What we do with your data, and what we don't have yet

Recruiters upload other people's CVs and interview notes, so this page says plainly what is in place, what is partly there, and what is not. We list the gaps because a page that lists only good news isn't worth much. Last reviewed October 2026.

The documents

Security and data handling

Access control, interviewer links, integrations, AI processing.

What we collect, GDPR and California information, your rights.

Data processing agreement

The template for how we handle candidate data for you. A signed version is agreed on request.

Make a privacy request

See, correct or delete your data, or object to something. Anyone can use it.

Status and known issues

Whether Rezumz is up, and what we are working on.

Where we stand

Separation between customers
Each account's data is separated in the database itself.
Detail
Jobs, candidates and feedback are protected by row-level security, not only by application code. Read-only Viewer teammates are blocked in the database.
In place
Sign-in protection
Two-step sign-in is available to each person.
Detail
An account owner cannot yet require it for the whole team, and there is no single sign-on (SAML).
Partly
Audit trail
Account-level actions are logged.
Detail
Keys, webhooks, team changes, exports, imports, interview links, offers and close-out are recorded for the owner. Individual views and edits of a candidate are not.
Partly
Data requests and deletion
Export and delete tools, and a request form for anyone.
Detail
Account owners can export all their data and delete jobs, candidates or the whole account. Anyone can submit a request on the privacy request page. Jobs can be set to delete their candidates automatically after they close.
In place
Candidate consent
Candidates who apply on a Rezumz page agree to a data notice first.
Detail
The time they agreed is stored with the application. Recruiters who add candidates in other ways are responsible for their own lawful basis and notices.
In place
GDPR (EU and UK)
Practices in place; no certification exists or is claimed.
Detail
In place: processor terms in a DPA template, a sub-processor list, export and deletion, retention settings, consent records and advisory-only AI scoring. Still open: lawyer review, a signed-DPA process, confirming whether an EU or UK representative is required, a written and tested incident-response plan, and EU data hosting.
Partly
CCPA and CPRA (California)
We do not sell or share personal information, and we honour requests.
Detail
We accept access, correction and deletion requests from anyone, whether or not the law applies to us yet. Where we act as a service provider, we help the business that collected the data respond.
Partly
Data processing agreement
A template is published; a signed version is agreed on request.
Detail
The template has not been reviewed by a lawyer, and the operating entity is not yet incorporated.
Partly
Where data is stored
United States only.
Detail
There is no EU hosting option. Transfers from the EU, EEA or UK rely on the safeguards the law provides, such as standard contractual clauses, to be confirmed in a signed DPA.
Partly
SOC 2
No SOC 2 report. We have not been audited.
Detail
A SOC 2 report is an independent audit, and we will not describe ourselves as SOC 2 compliant until we hold one.
Not yet
ISO 27001
Not certified.
Detail
We have not been assessed against ISO 27001.
Not yet
Single sign-on and ATS connectors
Not available.
Detail
Webhooks and a read-only API can connect Rezumz to other systems today.
Not yet

“Partly” means some of it is built and the rest is named in the detail. Our legal documents are drafts a lawyer has not yet reviewed, and the operating entity is not yet incorporated. If your procurement needs either, ask us first.

Who processes your data

These providers process data on our behalf. We will update this list before adding a new one that handles customer content.

Provider	What it does	Data involved	Location
Supabase	Database and sign-in	Accounts, jobs, candidates, interview feedback	United States (us-east-1)
Vercel	Application hosting	Requests to the app, including uploaded files while they are processed	United States, with a global edge network
Anthropic	AI analysis and writing	The text of a CV, job description or transcript you ask us to analyse, for that request	United States
Resend	Email delivery and CV inbox	Interview links, scheduling emails, close-out emails, CVs forwarded to your inbox address	United States
Dodo Payments	Payments and subscriptions	Billing details. We never see card numbers.	Set by Dodo Payments
Slack	Optional Slack bot	Only if you install it: commands and replies in your workspace	Set by Slack
Google Analytics and PostHog	Product analytics	Page views and in-product events. No advertising trackers.	Set by each provider

Requests and reports

A privacy request. If you applied to a company that uses Rezumz, that company decides what happens to your data, and we help it respond. Use the privacy request form and we will reply within 30 days, either acting on it or telling you who to contact.
A security problem. Email firststonelabs@gmail.com with the details and give us reasonable time to fix it before sharing it publicly.
A question for procurement. Ask for a signed DPA or an answer to a security questionnaire at the same address. We will tell you honestly what we can and can't answer yet.