Recruit CRM

GDPR overview

GDPR compliance is claimed explicitly, and in the vendor's capacity as a processor with the customer named as controller. The commitments are documented rather than merely asserted: a public data processing agreement in version 3.0 dated 26 March 2026, the 2021/914 standard contractual clauses plus the UK IDTA addendum for transfers, breach notification within 72 hours, assistance on data protection impact assessments, one free audit a year, and a named annex of roughly twenty-six sub-processors. A dedicated GDPR page maps the eight data subject rights onto specific product behaviours and links a certificate issued to Workforce Cloud Tech, Inc. Two gaps remain: no Article 27 representative is designated even though the publisher is established in the United States, and the GDPR page itself has not been revised since 20 July 2023.

Who owns the data?

The customer owns the data. Recruit CRM presents itself as a processor under the GDPR, with the subscribing agency acting as controller, and the privacy policy states that the vendor does not own, control or direct the use of information stored on the platform, accessing it only as far as needed to run the service or when the customer authorises it. For the AI features, the data processing agreement confirms that the controller keeps ownership of both inputs and outputs, while warning that AI-generated output may resemble output given to other users. Customers can export everything as a ZIP archive from the admin settings at any time.

Reuse rights

Customers may reuse whatever they put into and get out of Recruit CRM without asking permission: the controller retains ownership of inputs and outputs, and the whole dataset can be exported at any moment. Two limits apply. The data processing agreement forbids using the AI features to build competing models or presenting AI output as human-written, and the customer remains solely responsible for the lawfulness of what it processes, including the notices and consents candidates are owed. On the vendor side, the privacy policy states that personal data is never sold and is used only to deliver the service, while the agreement allows Recruit CRM and Workato to collect technical usage data and voluntary feedback in order to improve the AI features. Whether customer content itself feeds model training is addressed nowhere in the documentation.

Data retention & training

Hosting summary

Recruit CRM runs on Amazon Web Services and states that personal data is stored and processed in the United States and the European Economic Area, and possibly elsewhere through third parties used to operate the service. Traffic is encrypted in transit with TLS and data is encrypted at rest with AES, while passwords are hashed rather than stored. Production access requires multi-step authentication, and role-based access control keeps each organisation's records separate inside the application. Transfers out of the EEA are covered by the 2021/914 standard contractual clauses and, for UK data, by the ICO's international data transfer addendum. The data processing agreement publishes a named annex of roughly twenty-six sub-processors, among them AWS CloudWatch, OpenAI, Workato, Textkernel, Nylas, Datadog, MongoDB, Elasticsearch, SingleStore, Stripe, VONQ and Bright Data. One detail deserves careful reading: the public website resolves to an AWS node in Frankfurt, which describes content delivery rather than where customer records live. The declared storage jurisdictions remain the United States and the EEA.