# Security, DPAs and sub-processors

> How RemakeCV secures candidate data: encryption, access control, two-factor authentication, AI provider handling and how to request a Data Processing Agreement.

Source: https://www.remakecv.com/help/anonymisation-and-compliance/security-and-subprocessors
Last updated: 2026-08-21

---
Candidate data is transmitted over encrypted connections and stored in access-controlled cloud infrastructure. CVs are processed by AI providers under agreements that exclude training on your data. Accounts support two-factor authentication, and a Data Processing Agreement is available on request from support@remakecv.com.

## How is candidate data protected?

| Control | Implementation |
|---|---|
| Data in transit | Encrypted over HTTPS/TLS |
| Data at rest | Stored in access-controlled cloud object storage |
| File access | Downloads issued as short-lived signed URLs rather than public links |
| Account access | Password authentication with optional two-factor |
| API access | Bearer API keys, stored hashed, revocable, optionally time-limited |
| Company isolation | Every request is scoped to the authenticated company |

## Who processes candidate data?

RemakeCV uses sub-processors for hosting, storage and AI processing. A CV is sent to an AI provider to be parsed into structured data — that is what makes the formatting work.

The commitments that matter:

- **No training on your data.** Candidate CVs are processed to produce your output, not used as training data.
- **Scoped to purpose.** Data is sent for the specific processing you triggered.
- **Company isolation.** One customer's data is never accessible to another.

For the current list of sub-processors and processing locations, email support@remakecv.com — the list is maintained alongside the DPA so it stays accurate as providers change.

> **Note:** 
If your clients audit your supply chain — common in financial services, public sector and healthcare recruitment — request the DPA and sub-processor list before you need them, not when a questionnaire lands.

## What should my agency do?

The controls on your side matter as much as the ones on ours:

### Enable two-factor authentication

The single highest-value change you can make. See [two-factor authentication](https://www.remakecv.com/help/account-and-billing/two-factor-authentication.md).

### Remove leavers promptly

A dormant account with access to candidate data is a standing risk. See [user roles and permissions](https://www.remakecv.com/help/account-and-billing/user-roles-and-permissions.md).

### Set a retention position

Decide deliberately whether CV storage is on, and for how long. See [GDPR and data retention](https://www.remakecv.com/help/anonymisation-and-compliance/gdpr-and-data-retention.md).

### Rotate API keys

If you use the public API, rotate keys periodically and revoke any key whose holder has left. See [authentication](https://www.remakecv.com/help/api-reference/authentication.md).

## How do I report a security concern?

Email support@remakecv.com with the details. If you believe you have found a vulnerability, please report it privately rather than publicly, and give us a reasonable window to fix it before disclosure.

## Frequently asked questions

### Can I get a signed DPA?

Yes. Email support@remakecv.com and we will provide a Data Processing Agreement covering sub-processors and the roles of each party.

### Are candidate CVs used to train AI models?

No. CVs are sent to AI providers to produce your formatted output, under terms that exclude use of your data for training.

### Do you support SSO?

Two-factor authentication is available on all accounts. For enterprise single sign-on requirements, contact support@remakecv.com to discuss your setup.