# Security and GDPR

Where candidate data is stored, who can see it and how long it is kept. EU-hosted database, signed video links, Row Level Security, named subprocessors.

Canonical page: [https://showintro.com/security](https://showintro.com/security)

## Data security and GDPR compliance

Recruiting means processing personal data: CVs, contacts, recordings. Where it is stored and who can reach it comes up before a contract, not after. Below is what is stored, where, and for how long – without the usual line about robust encryption.

### Where the data lives

Three stores with three different jobs.

- **Structured data** — Profiles, vacancies, messages and metadata sit in Postgres on Supabase, AWS infrastructure in an EU region. Every table is closed by Row Level Security policies: access is decided in the database, not only in application code.
- **Video recordings** — Video is processed and delivered through Bunny Stream on our own domain, video.showintro.com. The library has no public content listing, and a player link is minted server-side for each individual view with a limited lifetime – an address copied out of the browser stops working.
- **Transport** — HTTPS and TLS 1.2+ on every request, HSTS at the edge, session cookies marked HttpOnly. Internal production access is held by a handful of operators and requires multi-factor authentication.

### Who sees what

Visibility is set by the candidate, not by a default.

- **The candidate** — Chooses the profile mode – private, link-only or open to search – and changes it at any time. Can delete an individual recording or the entire account along with the videos.
- **The recruiter** — Sees a profile once the candidate opened it to search, sent a link, or accepted a request. Contacts open only after an accepted request.
- **The hiring manager** — Sees only the candidates a recruiter added to a shortlist, and only while that shortlist stands. The candidate’s contact details are not available to them.
- **ShowIntro** — Production access is held by a handful of operators, behind multi-factor authentication, and is used for support and incident investigation. Recordings are not reviewed to train models.

### Your GDPR rights

Exercised from profile settings or through support.

- Request a copy of the personal data we hold about you.
- Correct inaccurate data directly in the profile, or ask us where a field is not editable.
- Delete the account and all related data from the settings page. Deletion is immediate and irreversible.
- Ask us to restrict processing while a dispute over accuracy or legitimate interest is open.
- Receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interest, profiling included.
- Withdraw consent at any time, without affecting processing that already happened.
- EU and EEA residents may complain to the data protection authority where they live.

### How long data lives

Nothing is kept indefinitely – every kind has a window.

- One year from the day they are uploaded. After that the file is deleted automatically and the profile offers to record a new one in its place. The candidate is warned 30 days before.
- Six to eighteen months depending on the recruiter’s plan; when it ends, access ends for the recruiter and their client alike.
- For as long as the account exists. Individual fields and recordings can be changed or deleted at any time.
- Profile, videos, comments and shortlist membership are deleted immediately and permanently.
- IP addresses, request timestamps and error events for up to 90 days, after which they are anonymised.

### Who else the data reaches

The outside services the platform runs on. The full list of recipients is in the privacy policy.

- Database, authentication and file storage. Processing within the EU, bound by a data processing agreement.
- Processing, storage and delivery of video recordings. Reached only through short-lived signed links.
- Hosting and edge network. Receives request metadata – URL, headers, IP – needed for routing.
- Only if you choose to sign in with them: the OAuth handshake runs under their own policies.
- Delivers transactional mail. Receives the recipient address and the message body; it has no access to the profile database.

### Frequently asked questions

- **Can we sign a data processing agreement?** — Send a DPA request to support@showintro.com and we will come back with terms. Our own subprocessors already operate under such agreements.
- **Do you hold ISO 27001 or SOC 2?** — No. The product is in beta, and we do not claim certifications we have not been through. The technical measures described on this page and in the privacy policy are verifiable without one.
- **Are candidate videos used to train models?** — No. Recordings are not passed to third-party models and are not used for training. The platform does not score candidates algorithmically – not by facial expression, not by tone of voice.
- **Why does a video only live for a year?** — Two reasons. A two-year-old recording no longer describes the person a recruiter is about to watch, and storing video costs money every month – a cost that ends up in the price list. A year is the window in which a self-presentation stays true. The candidate is warned 30 days ahead, and re-recording takes a few minutes.
- **What happens to the data when an account is deleted?** — Profile, recordings, comments and shortlist membership are deleted immediately and irreversibly. Only an irreversible hash of the sign-up address remains, for 30 days, to prevent abuse.
- **Who is responsible for candidate data, you or us?** — For the data a candidate enters into their own profile, ShowIntro is the controller. When a recruiter collects answers for their own vacancy, the roles follow the processing terms – which is what a DPA sets out.

## More

- [All documents (llms.txt)](https://showintro.com/llms.txt)
- [Agent instructions](https://showintro.com/agents.md)
- Contact: support@showintro.com