HR decisions you can defend. AI every team can sign off on.
Your people decide. Data stays in the EU. Security is certified. Everything your reviewers need, in one Trust Pack.
AgreementOur AI measures. Your people decide.
Hiring and promotion decisions change lives. That's why Skillvue never makes them. Our AI maps skills, measures them scientifically and explains every result. Your people make the final call.
Always a human decision.
Skillvue makes no automated hiring, promotion or mobility decisions. The final call always sits with your people.
Every score explained.
Each result comes with a written justification, so your people can challenge it, override it and explain it to candidates in plain language.
Classified and assessed under the EU AI Act.
We are a high-risk system under Annex III, point 4 (employment), as the law intends. We are the Provider, we've completed the conformity assessment under Annex VI, and our signed AI Act Declarations are available on request.
Your data. Your rules. EU soil.
You are the Data Controller. We are your Data Processor. We act only on your documented instructions, and we never treat your data as ours.
Processor, by contract.
A Data Processing Agreement (DPA) under GDPR Art. 28 comes with every contract. Your instructions, your purposes.
Stays in the EU.
All personal data is hosted on AWS in EU regions only (Milan, with Frankfurt and Dublin as fallback). Data never leaves the EU.
Never used to train our model.
Our LLMs are trained on a proprietary dataset, not on your candidates’ or employees’ data.
Identifiers removed before the AI sees them.
Names, emails and phone numbers are pseudonymised before any prompt reaches the model.
Ready-made DPIA and notice templates.
Start your Data Protection Impact Assessment (DPIA) and candidate information notices from our templates, not a blank page.
Security that's audited, not promised.
Our whole platform runs inside an Information Security Management System certified to ISO/IEC 27001 and checked by independent auditors every year.
Certified ISMS.
ISO/IEC 27001:2022, certificate ITA-10158-ISMS, issued by Scandinavian Certification AS. Extended to the cloud with ISO/IEC 27017 and ISO/IEC 27018.
Encrypted everywhere.
AES-256 at rest, TLS in transit, keys managed in AWS KMS with customer-managed keys. Enterprise SSO via SAML 2.0.
Watched 24/7.
Continuous threat detection and logging on AWS (GuardDuty, Security Hub, CloudTrail, WAF, Shield).
Attacked on purpose.
Annual penetration tests by an independent third party, using OWASP and OSSTMM methodologies.
Clear roles. No grey zones.
Liability starts where roles blur. Here is exactly who is responsible for what.
Builds to high-risk requirements, documents the system, provides oversight tools
Uses it as instructed, trains your people, keeps humans in the loop
Processes on your instructions, secures data, assists with data subject requests and breach notification
Decides purpose and legal basis, informs candidates
Everything your reviewers need. In one pack.
Skip the back-and-forth. Certificates and AI Act declarations are yours today. The DPA, DPIA template and security reports come straight from our Legal team, tailored to your review.
Independently certified. Built for EU regulation.
EU-hostedFAQ
Does Skillvue make hiring decisions?
No. Skillvue scores and justifies. A person on your team always makes the final decision.
Is Skillvue compliant with the EU AI Act?
Skillvue is classified as a high-risk AI system (Annex III, point 4). We've completed the conformity assessment by internal control (Annex VI) and our signed declarations are available. We track the AI Act timeline, including the Digital Omnibus, and update our documentation as it evolves.
Where is our data stored?
On AWS, in EU regions only. It never leaves the EU.
Do you train your AI on our data?
No. Our LLMs are trained on a proprietary dataset, not on candidates’ or employees’ data.
Who are your sub-processors?
AWS hosts the platform. Any sub-processor is listed in the DPA, and you're notified before any change.
Is ISO 27001 a GDPR certification?
No, and we won't pretend it is. It is evidence of appropriate security measures under GDPR Art. 32. Our GDPR compliance is demonstrated through the DPA and supporting documentation.
What happens if there's a data breach?
We notify you in time for you to meet your 72-hour obligation to the authority (GDPR Art. 33).
We're a bank / NIS2 entity. Can you meet our vendor requirements?
Yes. Our Legal team maps your vendor risk assessment to our certified ISMS and adapts contract annexes, including DORA-aligned clauses.
