How we protect your data
Firstview helps companies interview and assess candidates with AI. This page explains, in plain language, how we protect candidate and customer data.
Last reviewed: 19 October 2026
- EU-hosted databaseOur database runs in Frankfurt. Our servers run in Germany and Finland.
- EncryptedAll traffic uses TLS. Our database and file storage are encrypted at rest.
- People decideAI evaluates candidates against your criteria and explains every result. Your team makes every hiring decision.
- No face analysisWe do not analyze candidates’ faces or use facial recognition.
Where your data lives
Our database runs on Supabase in Frankfurt, Germany. Our application servers run on Hetzner in Germany and Finland. Some data is also stored outside the EU: Daily keeps interview recordings in the US, and our file storage on Cloudflare R2 is not limited to the EU. Some AI and speech providers outside the EU also process data, for example to convert speech to text. The sub-processor list shows each one with its region.
Security controls
- Encryption in transit
- All traffic uses TLS.
- Encryption at rest
- Our database and file storage encrypt data with AES-256.
- Private files
- CVs, recordings and transcripts are never public. They open only through signed links that expire.
- Credentials
- Integration tokens are encrypted with AES-256-GCM. Secrets live in a dedicated secrets manager, never in code.
- Infrastructure access
- Servers and the Kubernetes API are reachable only through a private network and VPN.
- Workload isolation
- Services run without root privileges, with restricted permissions.
- Backups
- Our database is backed up every day.
- Signed webhooks
- Requests from our providers are signed and verified.
- Customer isolation
- Each customer can see only its own data.
AI and candidate rights
Candidates know it is an AI
Every candidate is told that an AI conducts the interview.
People make the decision
The AI evaluates against your criteria and explains every result. It never rejects a candidate on its own.
No face analysis
We do not analyze faces or use facial recognition.
Transparent proctoring
We record tab changes, full-screen exits, camera-off and screen-share events. Reviewers see these events next to the interview.
- No emotion or personality analysis
- No model training on your data
- Human review on request
EU AI Act
We treat candidate evaluation as a high-risk AI system under the EU AI Act (Annex III). These obligations apply from 2 December 2027. We are preparing for them now and will publish our documentation on this page.
Candidate sourcing
We find candidates from public professional profiles. Anyone can ask us to delete their profile; we then block it from future searches.
Request removalSub-processors
| Apify | Public profile enrichment for sourcing | US | |
|---|---|---|---|
| Cartesia | Text-to-speech and speech-to-text (backup) | EU | |
| Cloudflare | Network, TLS and content delivery | Global | |
| Cloudflare R2 | File storage for CVs, recordings and transcripts | Not EU jurisdiction (global) | |
| Cohere | Search embeddings and ranking | US | |
| Daily | Live video and interview recordings | Live video: EU (Frankfurt). Recordings: US | |
| Deepgram | Speech-to-text and text-to-speech (backup) | EU | |
| Exa | Web search for candidate sourcing | US | |
| Google Cloud (Vertex AI) | AI models for the in-app assistant | EU | |
| Hetzner | Application servers and storage volumes | Germany, Finland | |
| Meta (WhatsApp Cloud API) | WhatsApp messages to candidates | US | |
| OpenRouter | AI model gateway to model providers | EU (most processing). Interview reports, live interviews and CV scoring decisions: global | |
| PostHog | Product analytics | EU | |
| Recall.ai | Meeting bot for recordings and transcripts | EU (Frankfurt) | |
| Resend | Email delivery | US | |
| Sentry | Error tracking | EU (Germany) | |
| Soniox | Speech-to-text and text-to-speech | US | |
| Supabase | Database and authentication | EU (Frankfurt) |
We tell customers 30 days before we add a new sub-processor.
Incident response
If a personal data breach occurs, we tell affected customers within 48 hours.
Report a vulnerability
If you find a security problem, email security@firstview.ai. We reply within 3 business days.
