Data & Security

Idea Match Studio processes candidate data on behalf of your organization. You are the data controller; IdeaTeam is the data processor. You decide what goes in; we keep it isolated, available and secure.

• Candidate profiles you add or import — name, contacts, location, skills, experience, CV content and files • Your organization's settings, templates, reports and vacancies • User accounts of your teammates (email + a hashed password) • Your billing profile for invoicing We only store what you or your integrations put in.

Every record belongs to exactly one organization. Access is scoped by row-level security at the database layer, so one client's data can never be read by another — even by mistake. Your candidates are yours alone.

Only the teammates you invite can access your organization's data, and each one gets the permissions you assign (view, edit, export, manage users, and so on). IdeaTeam staff do not browse your candidate data; access for support happens only at your request.

• In transit: all traffic is encrypted over TLS/HTTPS. • Passwords: hashed by our authentication provider — never stored in plain text. • Integration credentials (your ATS API keys/tokens) are encrypted at rest with AES-256-GCM before they touch the database.

To parse an uploaded CV, generate a tailored one or answer in the assistant, the relevant text or image is sent to our AI provider, Anthropic (Claude). It is processed to produce the result and is not used to train AI models. We send only what is needed for the task. An administrator can switch the organisation's AI tasks to DeepSeek instead (Admin → Settings → AI). It is off unless you choose it; DeepSeek then processes those tasks under its own terms. Interview recordings you choose to transcribe are sent to Groq (Whisper) for speech-to-text. On the paid Business and Enterprise plans the extended transcription is on by default (an administrator can go back to the standard one in Admin → Settings → Interview transcription): the recordings are sent to Deepgram, and to Groq only if Deepgram's reading fails. Deepgram does not keep them to train its models.

We rely on a small set of vetted providers to run the service: • Supabase — managed database & authentication • Vercel — application hosting • Anthropic — AI parsing, generation and the assistant • Groq — transcription of interview recordings • Monobank — payment processing • Google Workspace — transactional email • GitHub — a support request you send us is tracked there as a ticket, with the text you wrote Only when you switch them on: • DeepSeek — AI tasks, if an administrator chooses it instead of Claude • Telegram — notifications and AI agents, for people who connect their Telegram • Deepgram — speech-to-text for voice messages sent to an AI agent, and for interview recordings on the paid Business and Enterprise plans (the extended transcription; an administrator can switch it off) Each processes data only to deliver its part of the service.

You stay in control of your base at all times: • Edit or delete any candidate whenever you want. • Export your entire database (CSV / JSON) at any time. • When you close your account, your organization's data is removed from active systems.

We build in line with GDPR principles. Because you are the controller, data-subject requests (access, rectification, erasure, portability, restriction, objection) are handled by your organization, and we assist as your processor. Need a Data Processing Agreement (DPA) for your compliance file? Contact us and we'll provide one.

• We never sell your data. • We never share it with your competitors or other clients. • We never use your candidate data for advertising.

Questions, a DPA request, or a security concern? Email sales@ideateam.dev.