Your workforce data stays yours.

What we collect, why we process it, who helps us run the platform, and how we protect it.

Never used for training

Your data isn't used to train foundation models or to improve recommendations for other customers.

Encrypted

AES-256 at rest. TLS 1.2 or higher in transit.

Hosted in the US

Google Cloud Platform and Neo4j Aura, US data centers.

Least privilege

General staff have no access to customer data.

Data processing

What we process, and why.

Platform data

Organizational metrics such as roles, headcounts and typical salary bands. Core platform analytics do not process detailed personally identifiable information.

Business operations

Names, email addresses and contact details to manage communications, sales and support. Every automated email includes an opt-out link.

Website

Site visits, to improve the site and to identify interest for sales follow-up.

Compliance

Where we are on SOC 2.

We are implementing SOC 2 Type II compliance and an Information Security Management System, with security monitoring automated through Vanta. [Target attestation date.]

Until attestation, we rely on the certifications our infrastructure providers hold: Google Cloud Platform and Neo4j are ISO 27001 and SOC 2 compliant.

Sub-processors[List each sub-processor, its location and its compliance standards as text.]

Questions

Security and privacy FAQ.

Is our data used to train AI models?

No. Customer data is strictly isolated. Uploaded data and generated recommendations are specific to your organization and are not used to train foundation models or to improve recommendations for other customers.

Is our data separated from other customers'?

Yes. Logical separation in the database architecture means no other tenant can access your information.

How is data encrypted?

At rest, data is stored in Neo4j Aura on Google Cloud Platform with AES-256 encryption. In transit, it travels over HTTPS with TLS 1.2 or higher.

Who at Talent Rewire can access our data?

We follow least privilege. General staff have no access to customer data. Production database access is limited to a small number of senior engineers, granted only when needed for maintenance or support.

How do we sign in?

Single sign-on with Google or Microsoft, which lets you apply your own policies such as multi-factor authentication. Email and password sign-in is also available.

What happens to our data if we cancel?

Active data is permanently deleted from production 30 days after cancellation. Encrypted disaster-recovery backups age out on a six-month cycle.

Can we have data deleted immediately?

Yes. For a "right to be forgotten" request, active production data is removed immediately. Data in immutable backups ages out within the six-month cycle.