HireFace acts as a Data Processor for global recruiting teams. We provide the technical architecture required to ensure your candidate sourcing, video interviewing, and evaluation pipelines align with the UK GDPR, EU GDPR, and the UK Data (Use and Access) Act (DUAA). Updated October 2026.
🇪🇺 Sovereign EU Data Residency
Localized Processing: All candidate profiles and application data are stored in Cloudflare D1 databases jurisdiction-restricted to the EU. Resumes aren't stored at all — processed transiently in-flight to generate interview questions, then discarded.
Secure Video Storage: Recorded video interviews and media attachments are hosted entirely on Cloudflare R2 cloud storage, strictly bound to the EU region.
Zero High-Risk Transfers: Because candidate data remains within the EU/EEA zone, UK agencies do not need to perform complex Data Transfer Impact Assessments (TIAs) to use HireFace.
🛡️ Enterprise-Grade Infrastructure
Edge-First Security: Leveraging Cloudflare's global network, HireFace features built-in, enterprise-grade Web Application Firewall (WAF) protection, automated DDoS mitigation, and continuous threat monitoring.
Data Encryption: All data, candidate files, and video streams are encrypted in transit via TLS and at rest using AES-256 encryption.
Controlled Hiring Manager Access: Hiring managers never receive platform accounts or standing access. Each candidate review is shared via a unique, time-limited link — active for 7 days, and extendable only by the recruiter on request — so access always stays recruiter-controlled and expires automatically.
⚖️ Seamless Procurement Framework
Standard DPA Included: Our comprehensive Data Processing Agreement (DPA) is built to meet Article 28 requirements of the UK/EU GDPR and is automatically incorporated into our Terms of Service.
Statutory Compliance Intake: HireFace maintains dedicated workflows to process data-related queries or formal statutory requests via ravi.cloudworks@gmail.com.
⚡ Built-In Recruiter Compliance Features
The HireFace platform is engineered to let your agency enforce data compliance natively without manual overhead:
The Right to Erasure: A single "Delete Candidate" action permanently purges video interviews and associated metadata across all production databases.
Data Portability & DSAR: Instantly generate a clean, structured export of a candidate's entire profile history to easily satisfy Data Subject Access Requests (DSARs).
Automatic Retention & Purge: Video is automatically and permanently purged on a fixed schedule — 14 days on trial accounts, 90 days on paid accounts. Candidate contact/profile data kept for ongoing talent pool matching follows a separate, longer window — 18 months of inactivity — then is auto-deleted too. No manual steps or configuration required from your agency either way.
🍪 Cookies
Strictly necessary (always on): One session cookie keeps you signed in. This is essential to the service and doesn't require consent under PECR.
Live chat (Crisp) — the only non-essential cookie we use: Never set just by visiting the site. It's only set if you click "Chat with us" and accept — at that point Crisp's own cookies load to run that chat session. If you never open chat, no chat cookie is ever set on your device.
No analytics or advertising cookies: HireFace doesn't run Google Analytics, ad pixels, or any tracking script beyond the one above.
Need more detail? A full Data Processing Agreement, architecture diagrams, or answers to a specific security questionnaire are available on request — just reach out to ravi.cloudworks@gmail.com.