Security: Your consultants' data, kept apart and kept to what's needed
ConsultCV is run by Woberry AB, a company in Sweden. We process your workspace's data on your behalf under a data processing agreement.
- GDPR
- EU company
- Full export at any time
Each workspace's data is kept apart
Every consultant profile, assignment, request and match belongs to one workspace, and every read and write is filtered by that workspace. The database itself refuses a row that points into another workspace, and automated tests check that one workspace can never see another's data.
Inside a workspace, roles decide who sees what. Owners and admins manage members and billing, managers work on profiles and requests, and a consultant sees and edits only their own profile.
What we store, and what we don't
CV files you import are read in memory and not stored. What is stored is the structured profile you save from them, and the request text you paste.
Consultant photos and workspace logos are stored as files, in a folder of their own for each workspace. They are served from public addresses with a random, unguessable part: whoever has a file's address can open it, and nobody can list or guess the others.
Analytics is cookieless: nothing is stored on your device for analytics. Error reports leave out request bodies and cookies, and AI errors are scrubbed of CV text before they are sent.
The AI
CV import, requirement extraction, matching and tailoring run through the Vercel AI Gateway on OpenAI models. The gateway may send a request only to OpenAI, and only under terms that rule out training models on it. We send what each step needs: the CV text for an import, and for matching and tailoring the request and the profile without the consultant's name, contact details or photo. We do not use your content to train models.
The AI is told to use only facts in the profile. A requirement without evidence is marked No, and a rewrite that adds a number the profile doesn't have falls back to the original text.
Every match and tailored CV is a draft, and the app says so where it shows them. A person checks each verdict and can change it, and a person decides whom to propose: nothing leaves ConsultCV until someone exports it. Finding consultants for a request first ranks profiles by the words they share with it, without AI. The score only counts the verdicts (musts weigh 70, shoulds 30, a partly counts half), is never sent in an export, and is not a rating of the person. Photos never go to the AI.
Sign-in
People sign in with a password, a magic link sent to their email address, or Google. Everyone who signs up with a password gets a link to confirm their email address, and a workspace invitation can be accepted only from a confirmed address. Passwords are stored only as salted scrypt hashes. Sessions expire after a week without use. Workspace changes such as roles and invitations run on the server only, after the permission check for that role.
Export and deletion
Owners and admins can export the whole workspace at any time: every profile, assignment, request, candidate and setting as JSON, plus a Word CV per consultant.
An owner can delete the workspace. Its data is removed from the database at once and its subscription ends. Its photos and logos are deleted from file storage too; that step is best effort.
Anyone can delete their own account from their settings. A workspace they are the only member of goes with it; if they are the only owner of a workspace with other members, they must hand over ownership first.
Deleted data is removed from the live database at once. It can no longer be restored after 7 days, and it is gone from our database provider's encrypted backups after at most 30 days. A file whose deletion fails is reported to our team in an alert and the error logs, and we remove it by hand within 30 days.
Where the data is kept
Accounts, workspace content, photos and logos are stored in Frankfurt, Germany, and the app's server functions run there too.
- Vercel
- The app's server functions run in Frankfurt, Germany (fra1). Pages and files are delivered through Vercel's global network, from the location nearest you.
- Neon (Postgres database host)
- Frankfurt, Germany (AWS eu-central-1)
- Vercel Blob
- Frankfurt, Germany
- Vercel AI Gateway, routing to OpenAI
- United States, under the EU-US Data Privacy Framework or standard contractual clauses
- Stripe
- Our contract is with Stripe Payments Europe, Ltd. (Ireland). Some processing happens in the United States, under the EU-US Data Privacy Framework or standard contractual clauses.
- Resend
- EU region, Ireland (eu-west-1)
- Discord
- United States, under the EU-US Data Privacy Framework or standard contractual clauses
- Slack
- United States, under the EU-US Data Privacy Framework or standard contractual clauses
- Google handles the sign-in under its own privacy policy, on servers in the United States and other countries, under the EU-US Data Privacy Framework or standard contractual clauses.
The full list of subprocessors, and what each one processes, is in the privacy policy. Found a security problem? Write to support@consultcv.com.