The short answer
Ask an AI recruiter where data is stored and where it is processed, which suppliers are involved, and which decisions are taken automatically. Storage in the EU alone says nothing about where an AI model processes that data. Also ask about the protection of personal data, retention periods, access, and how queries or corrections are handled.
Distinguish between storage and processing
A database can be hosted in the EU whilst another service processes the content elsewhere. So ask about the full chain: chat, AI model, storage, and linked services such as email and calendar. Ask the supplier to explain which parties receive which data and what agreements govern that.
Ask for a current description of the processing chain. A logo from a well-known cloud or AI provider is not proof of the location or the terms of a specific application.
What does shielding personal data mean?
A model does not always need to see a name or email address to understand a response about work experience. A system can replace “Alex” with “[kandidaat]” and strip direct contact details from the text before presenting it to a model.
That is a protective measure, not an automatic guarantee that the text is fully anonymous. Free text can also contain indirectly identifiable information. Ask what the filter shields, what limitations are known, and how errors are handled. The original data and the processed text each require appropriate agreements.
Ask how the assessment and follow-up work
“AI-assisted” says nothing yet about whether a system only summarises or also determines who may proceed. Ask which criteria are used, who sets them, and whether a negative outcome automatically prevents an invitation. Discuss how incorrect information can be corrected and who the candidate can contact.
The Autoriteit Persoonsgegevens emphasises the importance of informing applicants and the rules on automated decision-making in the context of automated selection. The precise assessment depends on the system and the application. A general claim of being ‘GDPR-compliant’ is therefore no substitute for scrutinising how the system is actually configured. Read the AP’s explanation.
How does Red Rocket describe its approach?
Red Rocket stores candidate and client data within the EU and processes it within the EU. Identifiable personal data is removed or replaced prior to processing by a language model. The AI recruiter is configured with the vacancy, requirements, and context of the organisation.
The AI can assess responses automatically; an insufficient assessment may mean that a candidate does not receive an invitation without human intervention. The personal follow-up and the final hiring decision are separate steps. Therefore also read the privacy and AI explanation, including the limits of the filtering.
By “your AI” we mean a configuration around your way of working and insight for your team. That is not in itself a statement about ownership of an underlying language model. Record agreements about access, data, usage, and termination of the collaboration in concrete terms.
Frequently asked questions
Is EU-only the same as GDPR-compliant?
No. Processing location is one element. The purposes, legal basis, transparency, access, retention periods, and decision-making must also be assessed for the specific application.
What documents should you request from an AI recruitment partner?
Ask for a current description of the processing chain and the suppliers involved, agreements on processing and access, retention periods, and an explanation of automated assessment. Ensure that the necessary legal assessment is tailored to your specific application.
