Security, DPAs and sub-processors
How RemakeCV secures candidate data: encryption, access control, two-factor authentication, AI provider handling and how to request a Data Processing Agreement.
Candidate data is transmitted over encrypted connections and stored in access-controlled cloud infrastructure. CVs are processed by AI providers under agreements that exclude training on your data. Accounts support two-factor authentication, and a Data Processing Agreement is available on request from support@remakecv.com.
How is candidate data protected?
| Control | Implementation |
|---|---|
| Data in transit | Encrypted over HTTPS/TLS |
| Data at rest | Stored in access-controlled cloud object storage |
| File access | Downloads issued as short-lived signed URLs rather than public links |
| Account access | Password authentication with optional two-factor |
| API access | Bearer API keys, stored hashed, revocable, optionally time-limited |
| Company isolation | Every request is scoped to the authenticated company |
Who processes candidate data?
RemakeCV uses sub-processors for hosting, storage and AI processing. A CV is sent to an AI provider to be parsed into structured data — that is what makes the formatting work.
The commitments that matter:
- No training on your data. Candidate CVs are processed to produce your output, not used as training data.
- Scoped to purpose. Data is sent for the specific processing you triggered.
- Company isolation. One customer's data is never accessible to another.
For the current list of sub-processors and processing locations, email support@remakecv.com — the list is maintained alongside the DPA so it stays accurate as providers change.
If your clients audit your supply chain — common in financial services, public sector and healthcare recruitment — request the DPA and sub-processor list before you need them, not when a questionnaire lands.
What should my agency do?
The controls on your side matter as much as the ones on ours:
Enable two-factor authentication
The single highest-value change you can make. See two-factor authentication.
Remove leavers promptly
A dormant account with access to candidate data is a standing risk. See user roles and permissions.
Set a retention position
Decide deliberately whether CV storage is on, and for how long. See GDPR and data retention.
Rotate API keys
If you use the public API, rotate keys periodically and revoke any key whose holder has left. See authentication.
How do I report a security concern?
Email support@remakecv.com with the details. If you believe you have found a vulnerability, please report it privately rather than publicly, and give us a reasonable window to fix it before disclosure.
Frequently asked questions
- Can I get a signed DPA?
- Yes. Email support@remakecv.com and we will provide a Data Processing Agreement covering sub-processors and the roles of each party.
- Are candidate CVs used to train AI models?
- No. CVs are sent to AI providers to produce your formatted output, under terms that exclude use of your data for training.
- Do you support SSO?
- Two-factor authentication is available on all accounts. For enterprise single sign-on requirements, contact support@remakecv.com to discuss your setup.
Related articles
Last updated . Still stuck? Email support@remakecv.com or book a call.