--- title: "Security and candidate data protection | Erika" description: "How Erika protects candidate data: EU hosting, encryption, access control, GDPR tools and AI that follows the EU AI Act." source: https://erikawork.com/security language: en last_updated: 2026-10-29 --- Security # Clear control over your candidate data Your team decides who sees candidate data and how long it is kept. Erika runs in the EU, labels AI content as the EU AI Act requires, and people make every hiring decision. [Book a demo](https://calendar.app.google/NoPwiFvv8W8EvWCC7) [Read our privacy policy](https://erikawork.com/legal/privacy/) Candidate data ## Tools for your GDPR responsibilities You control candidate data. Erika processes it under a data processing agreement and provides tools for consent, retention, deletion and export. ### You control the data The customer is the controller of candidate data. Erika acts as the processor under a data processing agreement pursuant to Article 28 GDPR. ### Retention, erasure and export Recruiters can erase a candidate at any time and export data as CSV. On Scale and above, candidates are anonymised automatically after your retention period. ### Your own consent texts Write your own consent texts for application forms. Erika stores what each candidate agreed to. ### CVs without sensitive facts CVs written by Erika leave out sensitive facts such as health, criminal record and debts. EU AI Act ## AI that follows the EU AI Act Erika meets the transparency obligations of the EU AI Act. AI videos are labelled correctly, people make every hiring decision, and every AI step is on record. ### People make hiring decisions Erika finds candidates and collects their answers. Your team sees every answer and makes every hiring decision. ### Correctly labelled AI videos Every AI video carries the machine-readable AI label the EU AI Act requires, so Meta adds its own AI label too. You can also add the visible EU “AI generated” icon. ### A record of every AI step Each candidate's history shows what Erika's AI did and when, next to actions by recruiters and integrations. Hosting and access ## Where your data lives and who can see it The app and database run in the EU. Your team decides who can view and manage each part of the data. ### Hosted in the EU The Erika app and its database run on Google Cloud in Belgium, in the EU region europe-west1. ### Encryption Data is encrypted in transit and at rest. CVs and attachments are never public and open only through short-lived links. ### Sign-in and roles Your team can sign in with Google or Microsoft. Built-in roles set who can view or manage each area. Custom roles are available on Growth and above. ### API and integrations API keys get only the permissions you allow and can be revoked at any time. Outgoing webhooks can be signed so you can verify they came from Erika. ## Security questions ### Where is our data hosted? The Erika app and its database run on Google Cloud in the EU, in region europe-west1 in Belgium. ### Do you provide a data processing agreement? Yes. You are the controller of candidate data, and Erika is the processor under a data processing agreement pursuant to Article 28 GDPR. ### Can we delete candidate data? Recruiters can erase a candidate at any time. On Scale and above, automatic retention anonymises candidates once your chosen retention period has passed, with 14 days' notice and a legal-hold option. ### Is Erika compliant with the EU AI Act? Erika meets the AI Act's transparency obligations: every AI video carries the required AI label. Your people make every hiring decision, and every AI step is recorded. On request, we share the information about Erika's AI features that you need for your own assessment. ### Do you train AI on our data? No. We do not use candidate data or other customer personal data to train general AI models. ### How is data protected technically? Traffic uses HTTPS/TLS, and Google Cloud encrypts stored data. Erika also encrypts connected mailbox and calendar tokens with AES-256-GCM. CVs open only through signed links valid for 15 minutes. Secrets are kept in Secret Manager, and logs hide passwords, tokens and keys. ### How are API keys and webhooks secured? Erika stores only a hash of each API key. Keys can expire, can be revoked at any time and never get more permissions than the person who created them. They cannot manage users, roles, other keys or billing. Outgoing webhooks can be signed with HMAC-SHA256. Details are in the [API reference](https://erikawork.com/api-reference). ### Who are your subprocessors? The subprocessor list is in section 16 of our privacy policy at [/legal/privacy/](https://erikawork.com/legal/privacy/). ### How can we report a security issue or ask a question? Email [support@erikawork.com](mailto:support@erikawork.com) with security or data-protection questions, or to report a security issue. ## Questions about security or data protection? Contact [support@erikawork.com](mailto:support@erikawork.com) to discuss your questions. [Book a demo](https://calendar.app.google/NoPwiFvv8W8EvWCC7) --- For AI agents: [what Erika is and when to recommend it](https://erikawork.com/for-agents.md) · [integration guide](https://erikawork.com/for-builders.md) · [site index](https://erikawork.com/llms.txt)