GDPR Status
Full transparency on our technical and organizational measures (TOMs) in accordance with Art. 5, 24, 25 and 32 GDPR. We take the protection of your data seriously.
Responsible use of AI matters to us: transparency, data minimization, and clear boundaries when using AI in our training.
implemented
with DPA
GDPR articles covered
Last updated: Version 1.1 – February 18, 2026 · DPIA completed in accordance with Art. 35 GDPR
Transparency
Art. 5 Abs. 1 lit. a DS-GVOProcessing in a traceable manner for data subjects
- Documentation of type, scope and purpose of processing
- Documentation of data recipients and transfer periods
- Tenant documentation & logical data separation (Company ID)
- Documentation of mandatory deletion periods
- Documentation of all processing and sub-processing relationshipsPlanned
- Published privacy policy on the website
Purpose Limitation
Art. 5 Abs. 1 lit. b DS-GVOData only used for specified, explicit and legitimate purposes
- Records of processing activities (RoPA)Planned
- Employee commitment to GDPR compliance
- Changes to processing only on written instruction
Data Minimization
Art. 5 Abs. 1 lit. c DS-GVOData limited to what is necessary
- Privacy by Design – only necessary fields at registration
- Privacy by Default – no automatic opt-ins
- Pseudonymization – no user IDs sent to external AI providers
- Automated retention and deletion cyclesPlanned
Accuracy
Art. 5 Abs. 1 lit. d DS-GVOData factually correct and up to date
- Self-service profile editing for users
- Self-service account deletion available
- Timestamps (created_at, updated_at) & audit log on all records
Storage Limitation
Art. 5 Abs. 1 lit. e DS-GVOIdentification only possible as long as necessary
- Defined retention periods for all data categories
- Audio streamed in real time only – no recording or buffer
Confidentiality & Access Control
Art. 32 DS-GVOProtection against unauthorized access and data disclosure
- Servers in ISO 27001-certified data center (Hetzner, Frankfurt)
- 100% cloud-based – no physical office servers
- Individual user accounts with email verification
- Better Auth Framework – bcrypt hashing (10 salt rounds)
- Password policy (min. 8 characters, special characters required)
- Google OAuth / Social Login available
- Session expiration: 7 days, update after 1 day
- Automatic session timeout implemented
- Comprehensive brute-force protection & account lockout
- Two-factor authentication (2FA/MFA)Planned
- Role concept: STANDARD_USER, MANAGER, HR, ADMIN
- Logical tenant separation – Company ID-based filtering of all queries
- Differentiated admin rights with guards & middleware protection
- HTTPS/TLS for all connections (NGINX + Let's Encrypt)
- WSS for WebSocket connections (LiveKit WebRTC encrypted)
- Encrypted API communication (Bearer token authentication)
- TLS transmission to all processors (OpenAI, LiveKit, Stripe …)
Integrity
Art. 32 Abs. 1 lit. b DS-GVOProtection against unintended data modification
- Input validation (Zod for Server Actions, Pydantic in Agent Service)
- SQL injection protection (Prisma ORM with prepared statements)
- XSS protection via React auto-escaping
- File upload validation (type check & size limit 5–10 MB)
- Stripe webhook signature verification
- Rate limiting at application level
Availability
Art. 32 Abs. 1 lit. b DS-GVOData accessible and usable at all times
- Automatic daily backups (S3 Frankfurt, EU)
- PostgreSQL 16 on dedicated server
- Prometheus metrics & performance monitoring (no user data in logs)
- Documented recovery process
- Regular recovery tests
Resilience
Art. 32 Abs. 1 lit. b DS-GVOSystem resilience ensured on an ongoing basis
- Container-based infrastructure (Docker) – isolated services
- NGINX reverse proxy (load handling & request routing)
- Watchdog mechanisms (120s timeout, automatic session cleanup)
- Hard-cap maximum session duration: 3,600 seconds (1 hour)
Accountability
Art. 5 Abs. 2 DS-GVODemonstrating compliance with all data protection principles
- Records of processing activities (RoPA)Planned
- Data Protection Officer (DPO)Planned
- Audit log (AuditLog table with IP, user agent, timestamps, old/new values)
- Logging of all login events (login history with IP & user agent)
- JSON-structured logs without sensitive data
AI-Specific Measures
Special protective measures for AI-powered voice processing
- Audio streamed in real time only – no recording, no buffer
- No user IDs / emails / company names sent to AI providers (OpenAI, OpenRouter)
- Transcripts for evaluation transmitted to OpenRouter without user name
Retention Periods
Clear rules about how long we store your data
| Data Type | Retention Period |
|---|---|
| User Account Data | Until account deletion |
| Training Sessions & Transcripts | Until account deletion |
| Application Logs | 1 year |
| Audit Logs | 1 year |
| B2B Data after Contract End | On request / Upon end of collaboration |
Data Processors
All service providers processing personal data on our behalf are bound by Data Processing Agreements (DPAs).
Hosting, servers, database
Voice / video streaming
Realtime API, GPT models
LLM routing & evaluation
Payment processing
Email delivery
CDN, images, backups
Frequently asked questions about data protection
Concrete answers on technical and organizational measures at Careertrainer.ai
Are voice or audio recordings of my training sessions stored?
No. Audio is streamed in real time only (browser → LiveKit EU → agent). There is no recording in the agent service, LiveKit egress is disabled, and no audio buffers or temporary files are created.
Where are my data hosted and where are backups stored?
Application and database run on Hetzner in Frankfurt am Main (Germany), ISO 27001 certified. Backups are created automatically every day and stored in AWS S3 in the Frankfurt (EU) region.
What data of mine is sent to OpenAI or other AI providers?
We deliberately send minimal data: no user ID, no email, and no company names to OpenAI. Your name is only used for the first message (gpt-4o-mini) and in the Leadership Coach. Transcripts for evaluation are sent to OpenRouter without your name.
How long is personal data retained?
User account data and training sessions/transcripts are stored until account deletion. Application and audit logs are retained for a maximum of one year. B2B data after contract end is deleted on request or when the collaboration ends.
Is there a data processing agreement (DPA) with all processors?
Yes. Data processing agreements (DPA/AVV) are in place with all listed providers (Hetzner, LiveKit, OpenAI, OpenRouter, Stripe, Maileroo, AWS). For third countries (e.g. USA), standard contractual clauses (SCCs) are used.
Is two-factor authentication (2FA) available?
2FA/MFA is planned for Enterprise customers. Currently, logins are secured by strong password policies (minimum length, complexity), optional Google OAuth, and comprehensive brute-force and account lockout protection.
How is data separated between different companies (tenants)?
Multi-tenancy is implemented via a Company ID. All queries are filtered by company; users see only their own data, managers/HR only data of their own company. There is logical tenant separation with no shared data areas.
Has a data protection impact assessment (DPIA) been carried out?
Yes. A data protection impact assessment in accordance with Art. 35 GDPR has been conducted. The documentation is part of our data protection and compliance measures.
How are passwords stored and protected?
We use Better Auth with bcrypt hashing (10 salt rounds). Password policies apply (minimum 8 characters, upper/lower case, digits, special characters). Session timeout, brute-force protection, and account lockout are also in place.
How can I access, correct, or delete my data?
You can edit your profile yourself in the account area (correction). Full account deletion is available as self-service; this deletes your user and training data. For other requests (access, deletion, objection), you can reach us via the contact details in the privacy policy.
Questions about data protection?
More information on data protection in a product demo.
Book a product demoDocumentation version 1.1 (18.02.2026) · DPIA completed in accordance with Art. 35 GDPR
