Security & Compliance
Quibench is an EU-based company. We protect your data and your candidates' information, and we are transparent about where it is stored and processed.
EU-Based Company
Quibench is registered in Poland (EU) and operates under European data protection law.
EU-Region Storage
Files and data are stored in AWS eu-central-1 (Frankfurt); AI inference runs in AWS EU regions (EEA). No candidate CV data leaves the EEA — including AI processing.
Encryption
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256) by our cloud providers.
Built for GDPR
Designed around the UK GDPR and EU GDPR. For candidate data we act as your data processor.
Data Protection
We use industry-standard security measures to protect your data:
- Encryption in Transit: all data transfers use TLS 1.2 or higher
- Encryption at Rest: data stored by our cloud providers (AWS, Supabase) is encrypted at rest using AES-256
- Access Controls: access is scoped per workspace, so candidate data in one workspace is isolated from others
- Secure Authentication: industry-standard authentication with short-lived access tokens
Infrastructure & Data Location
Where your data lives:
- Database & files in the EEA: account data, the database (Supabase) and uploaded/generated CV files (AWS S3) are stored in the AWS EU region (Frankfurt, eu-central-1), within the European Economic Area
- Edge delivery (Cloudflare): our web apps are served through Cloudflare's global edge network, so web requests may transit Cloudflare infrastructure outside the EEA
- AI processing (AWS Bedrock, EU): CV content is processed by Anthropic Claude models hosted on AWS Bedrock in AWS EU regions (EEA) — see "AI Processing" below
- Backups & monitoring: encrypted managed backups and continuous monitoring and logging
AI Processing
CV content is processed by Anthropic Claude models hosted on AWS Bedrock in AWS EU regions (EEA). Candidate CV data is not transferred outside the UK/EEA for AI processing, and is never used to train AI models.
No candidate CV data leaves the EEA — including AI processing.
The models are hosted by AWS, our existing sub-processor, under a data processing agreement — AI processing involves no international transfer outside the UK/EEA. Data is used solely to process your request. You can additionally redact personal identifiers before processing to minimise the data shared.
GDPR & Your Data Rights
Quibench is the data controller for your account and billing data, and a data processor acting on your instructions for the candidate CV data you upload. For your own account data you can:
Right to Access
Request a copy of your personal data
Right to Erasure
Request deletion of your data; deleting your account removes it
To exercise your data rights, contact us at [email protected]. You also have the right to lodge a complaint with your data protection authority.
Candidate Data Protection
We understand that you process sensitive candidate information. We provide features to help you maintain compliance:
- Redaction: redact personal identifiers (names, contact details) before sharing a CV
- Data Control: you control when to delete processed CVs from your account
- No Data Sharing: we do not sell candidate data, and we do not share it with third parties for their own purposes
- Purpose Limitation: data is only used to provide the CV formatting service you request
Your Responsibilities
As a user processing candidate CVs, you are the Data Controller for candidate personal data. You are responsible for:
- Obtaining appropriate consent or a lawful basis to process candidate CVs
- Informing candidates about how their data is processed
- Responding to candidate data access or deletion requests
- Maintaining your own GDPR compliance obligations
Contact
For security concerns or questions about our data protection practices:
Privacy Contact: [email protected]
General Support: [email protected]