Security & Trust at Growthtastic
Your data and your applicants' data deserve the highest standards. Growthtastic is built on a privacy-first foundation - GDPR-compliant, EU AI Act aligned, encrypted at rest and in transit, and hosted on European infrastructure. The world's strictest data protection rules, applied to every customer.
How we protect your data
Privacy and security weren't added later. They've been built into Growthtastic from day one.
GDPR by design
We only collect data we're allowed to. Applicants can view, correct, or delete their own data right in the platform - no support ticket needed.
European infrastructure
All applicant data stays on servers within the European Union. No transfers to countries with weaker data protection rules.
EU AI Act ready
AI assists - humans decide. No automated hiring decisions. Every AI suggestion is transparent, explainable, and your team can always override it.
Encryption everywhere
Every connection is encrypted. Sensitive applicant data like CVs and personal details are also stored encrypted on our servers.
Strong authentication
Multi-factor authentication for every account. Roles and permissions make sure only the right people can see applicant data.
Transparency & control
You stay in control of your data. Account and data deletion any time, no questions asked. Detailed audit logs are available for Enterprise customers on request.
GDPR isn't a checkbox. It's our default.
Growthtastic is engineered around the GDPR's core principles - data minimization, purpose limitation, integrity, and accountability. Not patched in afterwards.
Read our Privacy Policy- Lawful basis documented for every category of personal data we process.
- Documented retention policies - applicant data is deleted after defined retention periods (typically 6 months after rejection, in line with German AGG documentation requirements).
- Data Subject Access Requests (DSARs) - applicants can request, correct, or delete their data directly.
- Right to be forgotten honored within statutory deadlines, with cryptographic proof of deletion.
- Data Processing Agreement (DPA) included by default - no separate contract negotiation needed.
- Annual review of our data processing register, available to enterprise customers on request.
AI prepares - you decide.
Recruiting is high-risk under the EU AI Act. Growthtastic is built so your team always remains in the driver's seat - no shadow algorithms making hiring calls.
Read our AI Transparency notes- No automated decision-making in the sense of GDPR Art. 22 - every shortlist, ranking, or rejection is reviewed by a human.
- AI suggestions are explainable: matched skills, missing requirements, and reasoning are shown next to every result.
- Bias mitigation: protected attributes (age, gender, origin, etc.) are not used as features for ranking or matching.
- Applicants are informed transparently when AI is used to assist screening - in line with EU AI Act transparency obligations.
- Human oversight built into the workflow - the recruiter, not the algorithm, decides who gets contacted.
- AI models and prompts are versioned and auditable for compliance reviews.
European servers. Strong encryption. No compromises.
Every byte of applicant data lives in the EU. Every connection is encrypted. Every backup is verified.
- Hosting exclusively in EU data centers. No data transfers to non-adequate third countries.
- TLS for all client traffic, with HSTS enforced on all production domains.
- Sensitive applicant data like CVs, contact details, and attachments is stored encrypted on our servers.
- Automated backups, encrypted end-to-end and stored offsite within the EU.
- Network isolation between services - databases and internal queues are not reachable from the public internet.
- Dependencies kept current - security advisories monitored and applied promptly.
Right access. Right people. Always.
Hiring data is sensitive. Growthtastic gives your team fine-grained control over who sees what - and forces strong authentication on every account.
- Passwordless by design - sign in via email one-time codes, authenticator apps (TOTP), or Passkeys (WebAuthn / FIDO2). No passwords to leak, reuse, or phish.
- Multi-factor authentication for every recruiter account, optionally enforced organization-wide.
- Granular roles & permissions - configure who can publish jobs, view applicants, manage billing, or invite users.
- Session management - revoke sessions remotely, see active devices, automatic logout on inactivity.
- Rate limiting and abuse protection on all authentication endpoints.
Applicants stay in control of their data.
Trust runs both ways. Applicants who use Growthtastic to apply have the same rights and tools as enterprise customers.
- Clear, plain-language privacy notice at every application form.
- Applicants can request a copy of their data, correct it, or delete it - directly from their account.
- Granular consent for talent pool inclusion - opt-in, not buried.
- Defined retention periods, with deletion handled in line with our GDPR-aligned policies.
- Withdrawn applications can be permanently erased on request.
Security questions, answered.
Common questions from procurement, IT, and works councils.
Is Growthtastic GDPR compliant?
Where is applicant data stored?
How does Growthtastic comply with the EU AI Act?
Do you sign a Data Processing Agreement (DPA)?
Are AI models trained on our customer data?
How long is applicant data retained?
Can applicants request deletion of their data?
What happens if there is a data breach?
Is multi-factor authentication available?
Hire with confidence. Start free.
Same security, same GDPR compliance, same EU hosting - whether you're a 5-person practice or a 500-person organization.