Trust & Security

What data we hold & for how long

Plain English — what's in our database, who can see it, when it disappears.

We do not sell, license or share Customer Data with anyone outside the sub-processors listed at outsor.work/sub-processors.html.

Security controls in production today

Every measure listed here is live in the production environment — not a roadmap promise.

What we don't have yet (transparent roadmap)

• ISO 27001 / SOC 2 Type II — both planned once Outsor passes 25 paying customers. We will share interim self-assessment artifacts on request from any Customer.
• External pen-test report — first pen test scheduled for Q4 2026, results shareable under NDA.
• DMARC enforcement policy — currently SPF + DKIM are live; DMARC will move from p=none to p=quarantine in Q3 2026.
• Customer-managed encryption keys (CMEK) — not currently offered; available on Enterprise pick.me plan only after 2027.

If something goes wrong — incident & breach response

Our commitments per GDPR Art. 33 and Art. 28(3)(f).

Notification timeline

• 0 – 24 hours — confirmed personal-data breach affecting Customer Data is triaged internally; severity and scope assessed.
• Within 72 hours — Customer's named billing contact is notified by email with: nature of the breach, categories and approximate number of data subjects/records affected, likely consequences, measures taken or proposed.
• Within 7 days — written post-incident report shared, including root-cause analysis and remediation plan.

What Customer gets from us

• Direct email to the billing contact (not a generic status page) within 72 hours.
• Full cooperation with Customer's own GDPR Art. 33 notification to the supervisory authority where Customer is the controller.
• Forensic access to relevant audit-log entries on request.
• No charge for incident-response time or follow-up calls.

Customer's own report-line

If you suspect a breach involving Outsor data, email info@archie-recruitment.com with subject "Security incident report — URGENT". Expect first response within 4 business hours during 09:00–17:00 CET; we monitor this inbox out-of-hours for the URGENT keyword.

Who can see your data inside Outsor

Customer-side access

• Recruiters on Customer's account see only data within their company tenant (enforced by Firestore security rules).
• Partner-agency users invited by Customer see only candidates they themselves submitted and the vacancies Customer explicitly shared with them — they cannot enumerate Customer's other candidates or partners.
• Candidates (if they hold a public-portal account) see only their own profile and application status — never Customer's internal notes or other candidates.

Service Provider-side access

• Single platform owner (Artur Seredziuk, founder) has elevated access for production support, restricted to one allow-listed admin email checked in code and security rules.
• Admin access is used only for: provisioning new Customer accounts, investigating reported security incidents, restoring data on Customer request.
• Every admin operation is logged in an immutable audit collection.
• Sub-processors have no human access to Customer Data — they process it through their APIs only (no support staff browses Customer records).

Regulatory compliance

GDPR / AVG

The full Data Processing Agreement at outsor.work/dpa.html sets out our Art. 28 obligations. Sub-processor changes are notified 14 days in advance with objection rights; Standard Contractual Clauses (Module 3, Processor-to-Processor) govern all non-EU sub-processors. Customer remains the Data Controller for all Personal Data uploaded; Outsor is the Data Processor.

EU AI Act (Regulation 2024/1689)

Outsor uses Anthropic Claude for CV quality scoring, summary generation and vacancy text drafting. Under the EU AI Act:

• All AI outputs are advisory only — no automated decision having legal or similarly significant effect on a candidate is taken by the Service (Art. 22 GDPR safeguard).
• Customer's recruiters retain full human review and decision authority on hire, reject and pipeline-stage changes.
• Transparency obligation: every Customer and User is informed at signup and in the legal hub that AI is used; AI features can be disabled per Customer at any time.
• No training: Anthropic does not use Customer Data submitted via the Outsor API to train its foundation models.

WAADI (Dutch Placement of Personnel by Intermediaries Act)

Outsor is a software platform for managing partner-sourced candidate submissions; it does not itself place workers, run payroll, or act as the contractual employer / hirer. Each Customer remains responsible for its own WAADI registration where applicable, and for verifying that each partner agency it invites is itself WAADI-registered where required. See the dedicated WAADI section at legal.html#waadi.

Polish tax law

Invoices issued by Outsor on Customer's behalf are retained for the 5-year period required by Ordynacja podatkowa Art. 86, regardless of Customer's own cancellation or deletion request (this is a legal retention obligation that overrides the standard 30-day deletion window for that category of data only).

Sub-processors at a glance

Full live list, transfer mechanisms and change-notification policy at outsor.work/sub-processors.html.

Talk to us

Need a signed DPA, custom security questionnaire response (SIG, CAIQ), or to flag an incident? We don't pass you to a ticket queue — you talk to the founder directly.