Security
Built to keep candidate data safe
Candidates trust you with their personal data. PontaHR is GDPR compliant, hosted in the EU, and encrypted at rest and in transit, so that trust is never the weak link in your hiring.
- GDPR compliant
- EU data residency
- Encrypted at rest & in transit
- SSO sign-in
- DPA on request
How we protect your data
GDPR from day one
PontaHR is built by an EU company, for teams hiring under EU rules. Candidate rights are supported across the board, from access and rectification to erasure.
Your data stays in the EU
Everything lives on AWS inside the European Economic Area, and EU candidate data is never transferred outside it. US hosting is in the works; until it ships, all data is EU-hosted.
Encrypted everywhere it matters
Your data is encrypted in transit and at rest, from the moment a candidate hits apply.
Sign in with Google or Microsoft
Single sign-on through the accounts your team already uses. No extra passwords to create, reuse, or leak.
Access on a need-to-know basis
Role-based access control keeps candidate data visible only to the hiring team it belongs to.
Multiple daily backups
Automated backups run several times a day, so a bad day can't turn into a lost dataset.
Our own access is limited too
PontaHR staff only touch production data when running or supporting the service requires it. Nobody is browsing your candidates.
Monitored around the clock
Error and performance monitoring alert us to problems before they become incidents.
DPO appointed, DPA on request
A Data Protection Officer is appointed, and a Data Processing Agreement is ready when you need it. One email to privacy@pontahr.com covers both.
Applied for a job through PontaHR?
Your application is visible only to the hiring team at the company you applied to. We never sell candidate data, and we never use it to build profiles across employers. The company you applied to is the data controller for your data, and we help them honor every GDPR request.
Sub-processors
We keep the list of vendors that touch your data short and vetted. The same list, with full legal detail, lives in our privacy policy.
- Amazon Web Services, Inc. Frankfurt, eu-central-1 Cloud hosting, file storage, email delivery, and AI processing (via AWS Bedrock)
- Stripe, Inc. Payment and subscription processing
- Intercom, Inc. In-app customer support and messaging
- PostHog, Inc. Product usage analytics (EU-hosted)
- Functional Software, Inc. (Sentry) Application error monitoring
- Datadog, Inc. Application performance monitoring
Optional integrations, processing data only if you connect them
- Google LLC Gmail / Google Pub/Sub Email integration
- Microsoft Corporation Microsoft Graph Email and calendar integration
Ready to see PontaHR in action?
Book a 15-minute demo and see how PontaHR makes hiring faster, simpler, and more enjoyable for your team.
No pressure, no sales pitch – just a real walkthrough.