Your data lives in the EU
Kit is hosted on Hetzner Cloud in Nuremberg, Germany. Your hiring data is encrypted at rest and in transit, protected by continuous security scanning, and stored within the European Union.
Privacy & GDPR
Data Residency
All core data is stored in the European Union (Hetzner Cloud, Nuremberg, Germany). No routine transfers of personal data to the United States for infrastructure purposes.
GDPR Compliance
Kit is designed to support your GDPR compliance obligations. We provide a comprehensive Data Processing Agreement, support data subject rights, and offer built-in tools for data export, anonymisation, and consent management.
Data Processing Agreement
Our DPA covers all GDPR Article 28 mandatory clauses, including sub-processor management, breach notification, audit rights, and international transfer safeguards.
View our DPAConsent Management
Built-in consent management for candidate data with configurable retention periods, automated expiry, renewal workflows, and audit trail.
Compliance
GDPR
- Data Processing Agreement available
- Data subject rights supported (access, rectification, erasure, restriction, portability, objection)
- Data export and anonymisation tools
- Consent management with audit trail
- EU-resident infrastructure
- Also covers UK GDPR and Swiss FADP
ePrivacy
- Cookie consent with opt-in for analytics
- Essential cookies only by default
- Microsoft Clarity restricted to marketing pages
- One-click email unsubscribe (RFC 8058)
CCPA
- No sale or sharing of personal information
- Data deletion on request
- Right to know what data is collected
- Non-discrimination for privacy rights
Infrastructure
Hosting
All infrastructure runs on Hetzner Cloud in Nuremberg, Germany (datacenter nbg1-dc3, network zone eu-central). No US sub-processors for core infrastructure. Your core application data is stored in the EU.
Data Residency
Your database runs on a private network with no public internet exposure. All database traffic stays on local interfaces. Backups are encrypted and stored within the EU.
Email Infrastructure
Self-hosted mail server in the EU. Candidate emails and notifications never touch third-party US email infrastructure. Full control over email delivery and data residency.
Edge Security
Cloudflare provides DDoS protection, web application firewall (WAF), and TLS termination. EU processing is available for Cloudflare services.
Encryption
In Transit
All connections are encrypted using TLS 1.2 or higher. HSTS is enforced. API endpoints require HTTPS.
At Rest
Sensitive personal data fields are encrypted at the application level (deterministic and non-deterministic encryption as appropriate). Storage volumes are encrypted. Backups are encrypted.
Payment Data
All payment processing is handled by Stripe. Kit never stores, processes, or has access to full credit card numbers. Stripe is PCI DSS Level 1 certified.
Application Security
Automated Security Scanning
Every deploy is gated on passing Brakeman (static analysis for Rails vulnerabilities), bundler-audit (Ruby gem CVE checking), and importmap audit (JavaScript dependency checking). No code ships without passing these checks.
Framework Protections
Built on Ruby on Rails 8, which provides built-in protection against CSRF, XSS, SQL injection, and other OWASP Top 10 vulnerabilities. Content Security Policy headers are enforced.
Code Review
All changes go through pull request review before merging. Automated linting (RuboCop, ERB Lint) enforces code quality standards.
Dependency Management
Automated alerts for vulnerable dependencies. Regular updates to framework and library versions. Continuous monitoring for security advisories.
Access Control
Authentication
User passwords are securely hashed. Optional two-factor authentication is available. Session management with secure, HTTP-only cookies.
Team Permissions
Role-based access control (owner, admin, member) per account. Granular permissions for hiring pipeline stages. Audit trail for sensitive actions.
API Security
JWT-based API tokens with scoped permissions. Rate limiting on all API endpoints. Token rotation supported.
Internal Access
Small engineering team (2-3 people). No shared credentials. Principle of least privilege for all system access.
Sub-processors
We use the following service providers. Full details including transfer mechanisms are in our DPA (Annex 3):
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure, compute, storage | Nuremberg, Germany |
| Cloudflare, Inc. | CDN, DNS, DDoS protection | Global (DPF + SCCs) |
| Stripe, Inc. | Payment processing | United States (DPF + SCCs) |
| Functional Software, Inc. (Sentry) | Error monitoring | United States (DPF + SCCs) |
Vulnerability Disclosure
Kit operates a Vulnerability Disclosure Program with a dedicated submission form, structured triage, and a published security policy. We aim to acknowledge reports within 48 hours.
Our security.txt is published at security.startupkit.app/.well-known/security.txt
Uptime & Status
We publish real-time status information including uptime history and incident reports.
View status page