Nora AI

GDPR overview

Nora AI publishes a full Data Processing Agreement, last updated February 2026, that expressly governs processing under the EU GDPR 2016/679 and the UK GDPR, with the customer as controller and Nora AI as processor. Transfers outside the EEA and the UK rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. The agreement covers assistance with data subject rights, a 48-hour breach notification, a 14-day objection window on new subprocessors, and confirms a completed DPIA for AI-based candidate evaluation. Two security documents describe practices as aligned with GDPR and CCPA principles. Two gaps stand out: no Article 27 EU representative is named anywhere, and the privacy policy's contact section is still an unfilled template that lists a mailing address as something to add. Compliance here is claimed alignment, not certification.

Who owns the data?

Under the Terms of Service you keep ownership of everything you submit, and Nora AI receives a worldwide, non-exclusive, royalty-free licence to use that content solely to provide and improve the Service. The security brief is more explicit about recruitment data: the customer remains owner and controller of candidate data, while Nora AI acts only as a processor. The Data Processing Agreement reinforces this, restricting processing to the customer's documented instructions and requiring all personal data to be deleted or returned when the contract ends, at the customer's election. Candidate answers and evaluations are disclosed to the recruiter who initiated the interview.

Reuse rights

An end user cannot freely reuse someone else's data. Candidate answers and evaluations are released only to the recruiter who initiated the interview, and that recruiter is contractually responsible for holding the consents that make the processing lawful in the first place. Within their own hiring process, recruiters can review, download, share and store transcripts and recordings, and send rejection or hiring emails from the dashboard. On the vendor side, the privacy policy allows aggregated, anonymised or de-identified data to be used to improve the service, while the Data Processing Agreement forbids any use of customer personal data — candidate records, interview content, transcripts, recordings, scores and results — to train, fine-tune or improve AI models, and equally forbids using it for bias audits or benchmarking on behalf of another customer.

Data retention & training

Hosting summary

Nora AI runs on a multi-cloud architecture hosted in the United States. The front end sits on Microsoft Azure, the back end on Kamatera Cloud Solutions, and files — resumes, audio and video — on AWS S3 with server-side encryption, versioning and cross-region replication. AI processing goes to OpenAI, speech-to-text to AssemblyAI and text-to-speech to Google Cloud. Payments run through Stripe and support through Gleap, the only subprocessor listed in both the EU and the United States. The subprocessor list is published and dated 7 February 2026, and any change carries fourteen days' notice with a right of objection. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, SQL Server databases use Transparent Data Encryption, and tenants are separated logically by a tenant ID verified on every query. Backups run daily with point-in-time restore; stated objectives are a 4 to 8 hour recovery time, a 24 hour recovery point and 99.5% availability. The privacy policy is explicit that data from users outside the United States is transferred there, with Standard Contractual Clauses and the UK addendum covering transfers out of the EEA and the UK.