Trust centre
The questions your DPO will ask
Venora processes CVs, which are personal data, for recruitment, which the EU AI Act treats as a high-risk use case. Here is where that data lives, what reads it, and what we do not do with it. Forward this page — it is written to be checked, not skimmed.
- Where is our data hosted?OVHcloud, in France
- Venora runs on OVHcloud in France. OVHcloud is a French company operating its own datacentres, so your candidate data sits with a European provider under European law.
- Which AI models read the CVs?Open-weight models, run by OVHcloud
- Named, so you can check them: gpt-oss-20b, gpt-oss-120b, whisper-large-v3, whisper-large-v3-turbo. These are open-weight models — the weights are published, and OVHcloud runs them on its AI Endpoints inside the same European infrastructure as the rest of the platform. That means there is no AI vendor in the data path at all. Your candidate data goes to OVHcloud and nowhere else; the organisations that originally published these weights never receive, see or process anything you put into Venora.
- Do you record or transcribe candidates?No — speech to text is for the recruiter
- No. The speech-to-text models are there for one thing: so a recruiter can talk to the assistant instead of typing. It is the recruiter’s own voice, and only when they choose to use it. Venora does not record or transcribe candidate interviews, and no candidate audio is processed.
- Do you train models on our data?No, never
- No. Candidate data and customer data are never used to train or fine-tune models — not aggregated, not anonymised, not with a setting you have to find and switch off.
- Where does the audit log live?With everything else, on OVHcloud
- The record of every decision — the score, the rationale, who confirmed it and when — is stored with the rest of your workspace on OVHcloud in France.
- How long is candidate data kept?You set the retention period
- You do. You are the controller of the candidate data in your workspace, so the retention period is yours to set, and data can be deleted before it expires — including at a candidate’s request.
- Can we get a data processing agreement?Yes, on request
- Yes. A data processing agreement is available on request — ask us and we will send it before you put any real candidate data into Venora.
- Is Venora certified to ISO 27001 or SOC 2?Not yet — stated plainly
- Not yet, and we would rather say so than imply otherwise. The infrastructure Venora runs on is OVHcloud's own, in their datacentres in France, under their certifications; Venora as a company does not hold a security certification of its own today.
What we have not published yet
Venora is early. Rather than fill this page with answers that sound complete, here is what is still to be documented:
- Encryption specifics, in transit and at rest
- What you get back, and in what format, if you leave
Ask us any of these and we will answer in writing, before you put real candidate data into the product.
Ask us directlyHuman oversight is an obligation, not a feature
Recruitment is a high-risk use case under the EU Artificial Intelligence Act, and the obligations that come with it — human oversight, traceability, record-keeping — apply to the way the system is built and to the way your team uses it. We do not claim conformity on your behalf. What we do is build so that meeting those obligations is the default, and give you the documentation of how.
- Venora ranks candidates and writes out the reasoning. It does not reject anyone, and there is no setting that lets it.
- A person confirms every decision, and the confirmation is recorded with who made it, when, and on what basis.
- Identifying details are removed before the analysis runs, so candidates are compared on what the role actually requires.
- The record stays with the vacancy, so a decision can be explained months after it was made.
Venora Match is a product of ARONEV, Unipessoal Lda (VAT PT519521285), trading as Venora, in Matosinhos, Portugal. The platform runs on OVHcloud in France.