Security & Compliance
Your data security and privacy are our top priorities. Learn about our commitment to protecting your information.
- Home
- Security & Compliance
Our Security & Compliance Standards
GDPR
Built around GDPR principles, with a full compliance review under way
CCPA
Supports California consumer rights: access, deletion and no sale of data
EU AI Act
Designed in line with the Act's transparency, human-oversight & fairness principles
EU Data Hosting
Data stored at rest in AWS EU regions, with AI processing moving inside the EU
About our EU AI Act alignment
We build and document our AI assessment features to align with the EU AI Act's requirements — transparency, human oversight, bias mitigation, data governance, accuracy and security. This covers WorkLab (recruitment and candidate evaluation) and LearnLab (education, training and assessment of learning outcomes), both of which fall under Annex III of the Act. The "EU AI Act" badge above reflects this alignment by design; it is not a certification or conformity mark. There is currently no official "EU AI Act certified" scheme.
Our AI assists, it does not replace, human decision-making. When you use WorkLab or LearnLab you act as the deployer under the Act and are responsible for ensuring qualified humans review AI-assisted outputs before any hiring, admission or evaluation decision, and for giving candidates and learners the required notices. See our Terms and Privacy Policy for the full allocation of responsibilities.
About our GDPR status
We are GDPR-aligned by design. We are undergoing a full GDPR compliance review and completing our remediation roadmap. There is no official "GDPR certified" scheme. Under Article 28, an institution judges a processor on its paperwork: a signed Data Processing Agreement, the security measures, the impact assessment and the sub-processor list.
All of it is published in our Trust Center, including the status and roadmap.
Trust Center
The paperwork a data protection officer asks for, in one place. Read it before procurement, and sign the DPA before any student data goes in.
GDPR status & roadmap
What is in place today and what is still being done.
Data Processing Agreement
Our processor obligations, ready for signature.
Sub-processor list
Every third party, what it does, and where.
Security measures
Technical and organisational measures, with status.
DPIA
Impact assessment for integrity monitoring and AI-assisted marking.
Record of processing
Each activity, its purpose, legal basis and retention.
International transfers
Transfer assessment and the move to EU-only AI.
Data retention
How long each type of data is kept.
Breach response
How we detect, contain and notify breaches.
Privacy policy
How we handle data as controller.
Student privacy notice
Plain-language notice for learners.
Cookie policy
What the LearnLab site stores in your browser.
Acceptable use
What LearnLab may and may not be used for.
Terms of service
The contract for using LearnLab.
These documents cover LearnLab. For WorkLab, or to request a signed DPA, write to privacy@upstack.ai.
App Age Ratings
Our app has been rated by international age rating authorities. Parental guidance is recommended.
ESRB
United States
Teen
PEGI
Europe
Parental Guidance
USK
Germany
12+
IARC
Global
12+
DJCTQ
Brazil
12
PCBP
Russia
18+
CCC
Chile
14+
Microsoft
Global
12+Interactive Elements
Content Descriptors
Ratings certified by IARC (International Age Rating Coalition) and regional rating authorities. Due to AI-generated content and user interactions, parental guidance is recommended.
Our Security Practices
Data Encryption
Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest by our cloud provider.
Access Controls
Role-based access control ensures only authorized personnel can access your data. Multi-factor authentication is available for all accounts.
Infrastructure Security
Hosted on AWS with enterprise-grade security. A full internal security and GDPR review was completed in August 2026, with independent testing on our roadmap. See our security measures.
Incident Response
24/7 monitoring with automated threat detection. Comprehensive incident response procedures ensure rapid response to any security events.
Your Data Rights
We believe in transparency and your right to control your personal information. Under GDPR and CCPA, you have the right to:
- Access - Request a copy of your personal data
- Rectification - Correct inaccurate or incomplete data
- Erasure - Request deletion of your personal data
- Portability - Receive your data in a portable format
- Object - Object to certain types of processing
- Restriction - Request limitation of processing
To exercise any of these rights, please contact us at privacy@upstack.ai
Sub-processors & AI Partners
We partner with industry-leading providers to deliver secure, reliable infrastructure trusted by enterprises and universities worldwide.
Amazon Web Services
Infrastructure
Cloud hosting, storage, and compute services. Regional deployment across EU, Middle East, and other regions.
OpenAI
AI Processing
One of the models we use, alongside offline models, to process sensitive data across WorkLab and LearnLab.
Anthropic
AI Processing
One of the models we use, alongside offline models, to process sensitive data across WorkLab and LearnLab.
Stripe
Payments
Secure payment processing. We never store card data.
All sub-processors are bound by Data Processing Agreements (DPAs) and maintain their own compliance certifications. Institutions can opt to have sensitive data processed exclusively by offline models — available for both WorkLab and LearnLab. For customers in the EEA, we are moving all AI processing into AWS EU regions. See the full sub-processor list.
AI Transparency & Ethics
Human Oversight
Our AI systems are designed to assist human decision-making, not replace it. All AI-generated assessments can be reviewed by qualified personnel, and candidates and learners have the right to request human review of AI decisions.
Fairness & Bias Prevention
We regularly audit our AI models for bias and fairness. Our assessment criteria are transparent, relevant to the role or learning objective, and designed to evaluate skills and understanding objectively regardless of demographic factors.
Transparency
Users are always informed when AI is being used to process their information or make recommendations. We provide clear explanations of how AI assessments work and what factors are considered.
Disclaimer: AI outputs are produced probabilistically and may be incomplete, inaccurate, or biased. They are intended to assist qualified reviewers, not to make automated decisions about candidates or learners. Bias audits, risk assessments and human-oversight controls reflect our alignment with the EU AI Act by design and are not a certification of compliance. Customers using WorkLab for employment decisions or LearnLab for education, training and assessment decisions act as the deployer under the Act and remain responsible for human review and for the notices given to candidates and learners.
Questions About Security?
Our security team is here to help. Contact us with any questions about our security practices or compliance.