Security
Clear control over your candidate data
Your team decides who sees candidate data and how long it is kept. Erika runs in the EU, labels AI content as the EU AI Act requires, and people make every hiring decision.
Tools for your GDPR responsibilities
You control candidate data. Erika processes it under a data processing agreement and provides tools for consent, retention, deletion and export.
You control the data
The customer is the controller of candidate data. Erika acts as the processor under a data processing agreement pursuant to Article 28 GDPR.
Retention, erasure and export
Recruiters can erase a candidate at any time and export data as CSV. On Scale and above, candidates are anonymised automatically after your retention period.
Your own consent texts
Write your own consent texts for application forms. Erika stores what each candidate agreed to.
CVs without sensitive facts
CVs written by Erika leave out sensitive facts such as health, criminal record and debts.
AI that follows the EU AI Act
Erika meets the transparency obligations of the EU AI Act. AI videos are labelled correctly, people make every hiring decision, and every AI step is on record.
People make hiring decisions
Erika finds candidates and collects their answers. Your team sees every answer and makes every hiring decision.
Correctly labelled AI videos
Every AI video carries the machine-readable AI label the EU AI Act requires, so Meta adds its own AI label too. You can also add the visible EU “AI generated” icon.
A record of every AI step
Each candidate's history shows what Erika's AI did and when, next to actions by recruiters and integrations.
Where your data lives and who can see it
The app and database run in the EU. Your team decides who can view and manage each part of the data.
Hosted in the EU
The Erika app and its database run on Google Cloud in Belgium, in the EU region europe-west1.
Encryption
Data is encrypted in transit and at rest. CVs and attachments are never public and open only through short-lived links.
Sign-in and roles
Your team can sign in with Google or Microsoft. Built-in roles set who can view or manage each area. Custom roles are available on Growth and above.
API and integrations
API keys get only the permissions you allow and can be revoked at any time. Outgoing webhooks can be signed so you can verify they came from Erika.
Security questions
Where is our data hosted?
Do you provide a data processing agreement?
Can we delete candidate data?
Is Erika compliant with the EU AI Act?
Do you train AI on our data?
How is data protected technically?
How are API keys and webhooks secured?
Who are your subprocessors?
How can we report a security issue or ask a question?
Questions about security or data protection?
Contact support@erikawork.com to discuss your questions.