Trust & Data
Trust & Data at Atlast
Hiring is built on trust. So is Atlast.
We design our platform to be transparent, privacy-first, and built with data protection in mind, in line with applicable EU and UK data protection requirements. This page provides a high-level overview of how we handle personal data, where it is processed, and who helps us deliver the service.
Data Protection & Privacy
Atlast Global Technologies acts as a data processor on behalf of its customers, who act as data controllers, for the purposes of applicable data protection laws.
We process personal data solely on documented instructions from our customers and in accordance with:
- The EU General Data Protection Regulation (GDPR)
- The UK GDPR and Data Protection Act 2018
Our data processing obligations are set out in our customer agreements and Data Processing Addendum (DPA).
Where Your Data Lives
Customer data is hosted within the European Union on AWS in Frankfurt. Some AI processing is carried out by providers outside the EU, including in the United States. Where data is processed outside the EU or UK, we rely on approved transfer safeguards including EU Standard Contractual Clauses (SCCs) and UK-approved international data transfer mechanisms.
Our Subprocessors
| Provider | What They Help Us With |
|---|---|
| AWS (EU) | Infrastructure, databases, file storage, application hosting, email delivery, and some AI processing |
| OpenAI | AI and large language model functionality, including real-time voice for AI-conducted interviews |
| Anthropic | AI and large language model functionality |
| AI request routing provider | Routing of AI requests to model providers (no content stored) |
| AI monitoring provider (EU) | Technical monitoring of AI requests (kept up to 15 days) |
| Interview recording provider (EU) | Interview recording and transcription (recordings removed after each interview) |
| File storage provider | Secure storage and delivery of CVs and files |
| Error monitoring provider (EU) | Performance monitoring and error tracking, with personal data removed |
| Real-time messaging provider | Live updates in the Atlast portal (no message history stored) |
| Outreach messaging provider | LinkedIn messaging for candidate outreach |
| Security provider | Bot protection on forms |
| Professional data providers | Candidate profile sourcing and contact enrichment |
A full list of named subprocessors is included in our Data Processing Agreement and is available to customers on request. Atlast remains responsible for the processing of personal data carried out by its subprocessors on its behalf. Customers are informed of changes to subprocessors in accordance with the DPA (minimum 14 days’ prior notice).
How We Use AI
Atlast uses AI to support hiring teams, not replace them. AI functionality assists with:
- Talent mapping, shortlisting and candidate outreach
- AI-conducted interview stages and interview notes
- Scheduling and candidate communications
- Insights and analytics
CV Scoring: Where enabled by an employer, the platform scores candidate profiles against a role. The scoring criteria, for example the weighting given to relevant experience or qualifications, are configured by the employer, not determined by the AI. The AI applies those criteria and produces a score. A human reviews all scored results before any decision is made. Scoring is transparent and employer-defined, not a black-box algorithmic ranking.
AI outputs are designed to support human decision-making. Final hiring decisions always remain with the customer. Atlast does not permit AI providers to use customer data to train general-purpose models, except where data is anonymised or explicitly agreed with the customer.
EU AI Act
AI systems used in recruitment are classified as high-risk under Regulation (EU) 2024/1689 (the EU AI Act). As a provider of AI used in hiring, Atlast operates as a high-risk AI provider under this regulation. We maintain technical documentation for our AI systems and are registering in the EU public AI database in accordance with applicable deadlines. Our AI systems do not use emotion recognition, biometric categorisation for protected characteristics, or any input prohibited under the Act.
Retention and Deletion
Rejected applications are automatically and permanently deleted 90 days after rejection. Employers can delete any application at any time, and candidates can request deletion through the Employer or directly with us.
When an application is deleted, the following are deleted immediately and automatically: the candidate’s profile and application, CVs and attached files, and interview recordings and transcripts. No copies are left with our file storage or recording providers, and deleted files cannot be recovered.
Any remaining copies expire automatically within fixed periods:
- AI model providers: within 30 days, held only for abuse monitoring and never used for training
- Encrypted database backups: within 30 days
- AI monitoring data: within 15 days
- Error reports: within 90 days, with personal data removed before they are sent
We do not create embeddings or search indexes of CVs. Recruiters’ conversations with Atlast’s AI assistants may mention candidates. These belong to the customer’s account and are kept while the account is active.
By default, Atlast application forms don’t ask for date of birth, nationality or photos. We only collect what’s needed to assess a candidate for the role.
Data Subject Rights
Atlast supports its customers in responding to data subject rights requests, including access, rectification, erasure, restriction, objection, and portability, in accordance with applicable data protection laws and the DPA.
Transparency Matters
We believe customers should be able to understand how their data is handled, without needing to read a legal textbook. If you have questions about data protection, privacy, or security at Atlast, contact us at: privacyandsecurity [at] this domain