Security & GDPR

Enterprise-grade security. Small-business simple.

Candidates trust you with their voice, their answers and their job search. We help you protect that trust with strict access control, full audit trails and complete GDPR compliance.

Candidate recordings belong to your workspace

Every simulation produces an audio recording, a transcript and a score. They are stored against your workspace only, visible to the seats you invite, and never shared with other customers.

✓Record and transcribe the simulation call the candidate consents to
✓Score that conversation and show your team the quotes behind the score
✕Share recordings or transcripts with anyone outside your workspace
✕Use candidate voices or answers to train AI models
✕Sell, rent or profile candidate data
✕Keep recordings after you delete a candidate or workspace
Full control, always. Delete a candidate result from Candidate results → Delete and its recording, transcript and score are removed. Candidates are told before the call that the conversation is recorded and scored, and can ask for deletion at any time.

Encryption in transit and at rest

All traffic runs over TLS 1.2+. API keys and workspace secrets are encrypted at rest in an isolated database. Recordings are served through short-lived signed URLs only.

No model training on candidates

Candidate audio, transcripts and CVs are never used to train models. They are processed to run and score the simulation you configured, and nothing else.

Full audit trail

Every simulation start, completion and score change is logged with timestamp and user — visible to your team in real time and exportable as PDF.

Candidate controls

One simulation link per candidate, single use, with a hard time limit. Revoke a link at any time — no need to resend.

Hosted in the EU / global edge

Application code runs on Cloudflare's global edge. The database and recordings are hosted in the EU (AWS eu-central-1).

Delete anytime

Delete a candidate result and its recording dies instantly. Delete your workspace and all associated data (except legally required billing records) is purged within 30 days.

GDPR

Built for European data protection

Lawful basis

We process personal data (your account details, candidate names, emails, recordings and transcripts) on the basis of contract performance (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f)) for fraud prevention and product security.

Data subject rights

You and your candidates can request access, correction, export or deletion of personal data at any time. Email privacy@getflyt.co — we respond within 30 days.

Data minimisation

We collect the minimum data needed to deliver the service. We never sell data, never use it to train AI models, and never serve third-party advertising.

Retention

Recordings and transcripts are retained for up to 12 months, then deleted. You can delete individual candidate results at any time.

Subprocessors

Cloudflare (edge hosting), Supabase (database, EU region), Clerk (auth), ElevenLabs (realtime voice), Google Gemini (scoring), Teamtailor (only if you connect it), Stripe (payments), Resend (transactional email). We sign a Data Processing Agreement with each.

International transfers

Any transfer of personal data outside the EEA relies on the European Commission's Standard Contractual Clauses (SCCs).

Exactly what data we process

Full transparency — nothing hidden.

Your account
Email address and display name, so we know who's signed in.
Candidate details
Name and email you or Teamtailor add, used to send and match the simulation.
Call audio
The recording of the simulation the candidate consents to before starting.
Transcript & score
The text of the call and the scored evidence shown in your candidate report.
Not processed
Anything outside the simulation — we do not read your ATS beyond the jobs and candidates you connect.

Questions about security?

Our team is happy to walk you through our architecture, sign a DPA, or complete your security questionnaire.

Contact our team Read the Privacy Policy