Minimum security standards for Recruiters operating the Platform in compliance with GDPR
AITACS Talent implements server-side and application-level security measures to protect Candidate data. However, compliance with GDPR is a shared responsibility. As a Recruiter (Data Controller), you are responsible for the security of your own device, network, and work environment.
This document defines the minimum security measures you must follow when using the Platform. These requirements align with GDPR Article 32 (security of processing).
Failure to comply with the mandatory requirements listed below releases the Provider from liability for any data breaches, unauthorized access, or data loss resulting from the Recruiter's non-compliance. See Terms of Service and Recruitment Data Sharing Agreement.
Use a currently supported operating system with automatic security updates enabled: Windows 10 or later, macOS 12 (Monterey) or later, Ubuntu 22.04 LTS or later, ChromeOS, iOS 16+, or Android 13+.
GDPR Art. 32(1) — appropriate technical measures against unauthorized processing. Unsupported OS versions no longer receive security patches.
Install and maintain an active, up-to-date antivirus or endpoint detection and response (EDR) solution. Windows Defender (built-in) is acceptable. macOS users should ensure Gatekeeper and XProtect are enabled.
GDPR Art. 32(1) — protection against accidental or unlawful destruction, loss, or alteration of personal data.
Enable full-disk encryption on all devices used to access the Platform. Use BitLocker (Windows), FileVault (macOS), or LUKS (Linux). On mobile: iOS encryption is enabled by default with a passcode; on Android, enable device encryption in Settings.
GDPR Art. 32(1)(a) — encryption of personal data. Protects data if the device is lost or stolen.
Set a strong password or passcode on all devices used to access the Platform. Minimum 12 characters for computers, minimum 6-digit PIN or biometric authentication for mobile devices. Do not share your device password with anyone.
GDPR Art. 32(1)(b) — ensuring ongoing confidentiality of processing systems.
Enable two-factor authentication for your AITACS Talent account. Use an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) or hardware key (YubiKey). SMS-based 2FA is acceptable but less secure.
GDPR Art. 32(1)(b) — prevents unauthorized access even if your password is compromised.
Use a separate, dedicated browser profile for recruiting work with the Platform. Do not mix recruiting work with personal browsing, social media, or untrusted websites in the same browser profile. This isolates cookies, localStorage, and cached data.
Reduces exposure to browser-based attacks and prevents cross-contamination of session data.
Do not enter a Candidate's age, gender, race, ethnicity, religion, marital status, or health information into free-text notes or custom fields — the Platform's schema intentionally excludes these fields as an anti-discrimination safeguard, and reintroducing them defeats that protection. This requirement applies to manual data entry generally; it is separate from the résumé/document-import feature, which reads whatever the source document itself contains (see Privacy Policy §3.2).
GDPR Art. 9 / anti-discrimination law — special category and protected-characteristic data should not be introduced into a hiring workflow where it is not already required and lawfully justified.
Do not leave your device unattended and unlocked while the Platform is open. Lock your screen when stepping away (Windows: Win+L, macOS: Ctrl+Cmd+Q). Do not allow unauthorized persons — including family members, colleagues not involved in the hiring process, or office visitors — to view or access the Platform.
GDPR Art. 32(1) — appropriate technical and organizational measures.
Keep your operating system, web browser, and all installed software up to date. Enable automatic updates where possible. Pay special attention to browser updates, as the Platform runs in the browser.
Unpatched software is the primary vector for data breaches.
Do not access the Platform over public Wi-Fi networks (cafes, airports, hotels, coworking spaces) without an active VPN connection. Public Wi-Fi is inherently insecure and susceptible to man-in-the-middle attacks. Use your mobile hotspot or a trusted VPN service.
GDPR Art. 32(1)(a) — appropriate technical measures for transmission security.
Use a dedicated password manager (1Password, Bitwarden, or Dashlane) to generate and store unique, strong passwords for every account. Never reuse passwords across services.
Eliminates the risk of credential stuffing attacks — the most common breach vector for cloud applications.
Configure your device to lock automatically after 5 minutes of inactivity or less. On mobile devices, set auto-lock to 1–2 minutes.
Prevents unauthorized access if you forget to manually lock your screen.
Periodically export your data from the Platform and store encrypted backups on an external drive or encrypted cloud storage. This protects against data loss due to account issues, server outages, or accidental deletion.
Ensures data availability even in disaster scenarios.
Use a reputable VPN service (NordVPN, ExpressVPN, ProtonVPN, Mullvad) for all work sessions, not only on public Wi-Fi. This adds an encryption layer between your device and the internet.
Provides defense-in-depth for data in transit, especially valuable when working from home networks with IoT devices.
If possible, use a dedicated device for recruiting work — separate from personal use. This eliminates the risk of personal browsing, downloads, or applications compromising the security of Candidate data.
The strongest physical access control for solo recruiters and small agencies.
Enable 2FA on your email account (the one used for AITACS Talent login). Your email is the recovery mechanism for your account — if your email is compromised, your Platform account is at risk. Be vigilant about phishing emails.
Email compromise is the #1 vector for account takeover. Securing your email secures your entire digital identity.
Establish a habit of keeping free-text interview notes focused on job-relevant observations (skills, responses to questions, fit against requirements) rather than personal impressions unrelated to the role.
Reduces the chance of protected characteristics being recorded incidentally in free text, and improves the quality of the AI's de-identified analysis.
Log out of the Platform when your work session is complete. Clear browser data periodically. Do not save your Platform password in the browser — use a password manager instead.
Minimizes the window of opportunity for unauthorized access through an open session.
Before entering any Candidate's data into the Platform, obtain their consent using the template provided (Informed Consent Template). Store signed consent forms securely — either digitally (encrypted) or physically (locked cabinet).
GDPR Art. 6(1)(a) — consent as the primary legal basis for Candidate data processing.
If you suspect any unauthorized access to your account, unusual activity, or if your device is lost or stolen — immediately change your password, revoke active sessions, and notify the Provider at talent@aitacscrm.app. Time is critical in breach containment.
Print this checklist and keep it at your workstation. Verify compliance periodically.
If you have questions about these security requirements or need assistance with implementation:
Artem Chukov — Provider / Security Contact
Email: talent@aitacscrm.app
Web: aitacscrm.app/talent
Terms of Service · Privacy Policy · Informed Consent Template · Cookie Policy · Data Processing Agreement (DPA) · Recruitment Data Sharing Agreement · Subprocessor List · Security Requirements · Incident Response Policy · Security Overview · Refund Policy · Copyright Policy · Contact Us