Security & compliance
Built for GDPR-conscious hiring.
Screening CVs means handling candidates' personal data. Here is how Marxel keeps that controlled, explainable, and in your hands — with the documents your team needs for due diligence.
We don't train AI on your data
We do not use your data to train any Marxel-owned AI models. Our AI providers do not use data sent through their APIs to train their models by default.
Humans make the hiring call
Best match bands and supporting CV evidence assist people. All hiring decisions remain with your organisation, and candidates can request human review of any assessment.
UK GDPR-aligned, with a full DPA
Built around the UK GDPR, EU GDPR, and the Data Protection Act 2018. A complete Data Processing Agreement is available, including SCCs and the UK IDTA.
Encrypted and access-controlled
Data is encrypted in transit (TLS 1.2+). At-rest encryption is provider-managed where supported. Marxel also encrypts connected mailbox and ATS credentials, with role-based access, authentication, and SAML single sign-on on the Business plan.
How we handle data and AI
Your CVs are not used to train AI
We do not use your data to train any Marxel-owned AI models. Anthropic is our primary provider for CV parsing, screening, and other AI features. OpenAI generates text embeddings for candidate search and retrieval. Google's Gemini API is enabled as a backup for supported tasks when the primary provider is unavailable or declines a request. Under their commercial API terms, submitted data is not used to train their models by default. Each provider is a sub-processor bound by data processing terms.
Decisions stay with people
Best match bands and supporting CV evidence assist human decision-making — they don't replace it. All hiring decisions remain with the organisation using Marxel, and candidates have the right to request human review of any automated assessment.
Retention & data location
- Candidate data
- Approved policy: 365 days after the last meaningful recruitment activity by default; recruitment workflow records may be retained for up to 730 days. Active recruitment can extend the applicable lifecycle only through a reviewed 90-day exception, capped at 730 days from the original activity anchor.
- Cached AI processing results
- Known local entries are purged on deletion where a reliable key exists and may expire sooner under configured TTLs; provider caches have separate controls
- Customer account data
- Duration of the account plus 2 years
- Billing records
- 7 years (legal requirement)
The approved policy provides a 30-calendar-day read-only grace period for organisation deletion. Legal Holds take precedence, and approved active-recruitment exceptions can pause final deletion through a reviewed 90-day exception capped at 730 days from the original activity anchor. The daily candidate retention sweep currently runs in dry-run mode: it identifies expired records without automatically deleting them. Automatic deletion has not yet been enabled. Deleting data from Marxel does not delete records held in a customer's ATS. Backup and provider copies may persist after active-system deletion; no fixed backup period or per-record backup deletion guarantee is published until the relevant controls are verified.
Application database records are hosted in the European Union on Railway. CV file storage uses Google Cloud Storage; existing files may also remain with UploadThing.
Provider locations and international transfer safeguards are detailed in our sub-processor list and Privacy Notice.
Security measures
- Encryption in transit (TLS 1.2+); provider-managed encryption at rest where supported
- Application-level encryption for connected mailbox and ATS credentials
- Role-based access controls and authentication
- SAML single sign-on (SSO) on the Business plan, with optional enforcement for your email domain
- Automated dependency vulnerability checks
- Employee confidentiality obligations, access on a need-to-know basis
- Customer incident notification commitments in our DPA
We use a small set of vetted sub-processors for hosting, AI processing, email, and payments, and give at least 14 days' notice before engaging a new one.
Certifications
Marxel does not currently hold SOC 2 or ISO 27001 certification. Our providers' security information is linked from the sub-processor list; their certifications do not certify Marxel.
Documents for your records
Our public data-protection documents for your team's review.
Questions about data or compliance?
We're happy to walk your security or procurement team through how Marxel handles candidate data. For the legal side, see whether AI CV screening is GDPR-compliant.