Data accumulates by default
Many systems retain profiles indefinitely because deletion is operationally inconvenient. That creates unnecessary risk when the lawful basis for storing candidate data is time-limited.
Privacy and compliance
What GDPR-compliant recruiting requires
GDPR-compliant recruiting requires more than a privacy statement. The system has to capture lawful basis, enforce retention windows, delete candidate data on schedule, and preserve logs that explain how an applicant moved through the hiring workflow.
Many hiring products treat compliance as a documentation layer around a general-purpose database. That leaves operational gaps when a profile must be retained for a limited period, removed from storage, or reviewed under a subject access or deletion request.
Recruitment orchestration handles those requirements more directly because workflows can encode when data is created, when it is evaluated, and when it must be removed. Vekt uses that model to connect hiring actions with enforceable privacy behavior.
Problem
Why privacy breaks in conventional hiring tools
If an organization cannot inspect where applicant documents live, which email events were sent, or when a retention deadline expires, privacy compliance depends on manual workarounds.
Policy drifts away from implementation
Privacy controls are only reliable when retention, access, and deletion are implemented in the same system that evaluates the candidate.
Mechanism
How data retention is enforced
A workflow can apply retention logic as a scheduled operation rather than as an administrative reminder.
Retention and deletion as workflow stages
After an individual applies, the system stores the candidate record and resume file with a retention horizon. Status updates, warning emails, and purge tasks run against that same record. When the retention period expires, the workflow deletes the database entry and the associated file.
This is where recruitment orchestration differs from ATS software. The privacy rule is part of system execution, not a separate compliance checklist.
Implications
Privacy and GDPR implications
The practical questions are concrete: what is stored, why it is stored, who can access it, and when it is deleted.
Lawful basis and data minimization
Structured workflows make it easier to justify each field and each document collected from the applicant. They also reduce the incentive to retain unused profile data.
Access control and auditability
When resume access and status changes are mediated by authenticated routes and logs, teams can inspect how personal data was used and by whom.
FAQ
Frequently asked questions
Does using Vekt make our recruiting GDPR-compliant?
No. Vekt provides mechanisms: a retention window, automated deletion of candidate data, CV files served through controlled routes rather than the public web root, and logs of how each candidate moved through the workflow. Your lawful basis, privacy notice, DPIA and answers to data subject requests remain your organisation’s responsibility, with your own legal advice.
How long can we keep candidate data under the GDPR?
The GDPR sets no fixed period. Its storage limitation principle (Article 5(1)(e)) says personal data should be kept no longer than necessary for the purpose it was collected for, and national supervisory authorities publish their own guidance. In Vekt the period is a setting, RETENTION_DAYS, which defaults to 90 days; a scheduled job then deletes the candidate record and the CV file.
Where is candidate data stored when Vekt is self-hosted?
On infrastructure you run: the database and the uploaded CV files sit on your own server, and CV files are kept outside the public web root. When a CV is scored, its redacted text is sent to the AI provider you configure. With a hosted API such as OpenAI or OpenRouter that text leaves your infrastructure; with a local model through Ollama it does not.
Is AI CV screening automated decision-making under GDPR Article 22?
It can be. Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, and Recital 71 names e-recruiting without human intervention as an example. By default Vekt never rejects a candidate on the score alone: low scores are marked Needs review and no rejection email is sent until a recruiter decides. Automatic rejection is an explicit opt-in, recorded per evaluation.
Why does self-hosting matter for candidate data?
Self-hosting does not satisfy the GDPR by itself. It means your organisation decides where candidate data lives, who can reach the server and when data is deleted, and you can read the source code to check what the software does with it. With a hosted product the vendor runs that infrastructure, and you rely on its data processing agreement and documentation.
Vekt approaches GDPR-compliant recruiting as a systems problem. Privacy depends on how workflows retain, audit, and delete candidate data, not only on what policy documents promise.
The controls described on this page are mechanisms, not compliance. Vekt does not determine your lawful basis, write your privacy notice, run your DPIA, answer your subject access requests, or make your organisation GDPR-compliant — and configuring it badly will not keep you on the right side of the regulation. Those remain yours, with your own legal advice.