Access only with an assignment
Every request to the app is checked against the person's assignment, not only against their login. Without an explicit assignment, nobody sees a client. When an assignment is withdrawn, that takes effect immediately.
GDPR and the EU AI Act
We take data protection, data security, data separation and continuous compliance seriously. This page describes how that is implemented.
Whoever talks about a key role talks about people and strategy.
In an HIHB session, management, the department and HR speak openly about why a role is being filled again, what did not work, and where the company is headed. That information belongs to the company. The HIHB app (High-Impact Hiring Blueprint) is built so that it stays there.
The architecture diagram is built for large screens. Open the diagram at full size and pinch to zoom.
A separate data space for each client
Each client has its own database file, and so does each session. Cards, skills and documents of one client are kept there and nowhere else. There is no path by which the content of one client is written into another client's data space. A query cannot return someone else's data, because the other file is never opened. Deleted data is overwritten, not merely hidden.
Pseudonymisation before the AI
Before any text reaches the AI, the app replaces people's names with placeholders such as „[Person A]“. The model receives the context without direct personal reference. Responses are checked before they are shown or stored. The context comes only from the client in question and is assembled afresh before every call.
AI in the EU: Claude via Amazon Bedrock
HIHB uses Claude, the language model made by Anthropic. In production, Claude runs through Amazon Bedrock in EU regions, Frankfurt among them.
- Processing stays inside the EU.
- Inputs and outputs do not go to Anthropic. Bedrock runs the model in its own accounts, which model providers cannot access (AWS documentation).
- Bedrock does not use the data to train models (AWS).
- HIHB runs Bedrock without storing inputs (zero data retention, AWS Security Blog).
- A data processing agreement with AWS is in place.
Anonymous patterns: learning without giving anything away
Out of many sessions, patterns emerge: the tasks, goals and skills that are typical of a role family. These patterns are available to every company as suggestions. So that nobody becomes identifiable from them, fixed stages apply:
- Confirmed content only, and only where the company has agreed to its use.
- A filter removes names, figures, companies, customers and people's job titles.
- An entry becomes visible only once it appears in at least three clients independently of one another.
- A human releases every new entry.
- Thirty days after release, the link to the origin is deleted. After that the pattern pool carries no identifier of account, client or session.
The suggestions flow back into every account anonymously. They reach the AI only once someone in a session accepts a suggestion.
Every AI output is labelled
AI suggestions are visibly marked in the app until people adopt them. In addition, every AI output carries a machine-readable provenance record of the kind required by Article 50 of the AI Act. A verification address makes it possible to establish whether a text was produced by the HIHB app, without any content being disclosed.
Operations layer: the server in Germany
Beneath the application sits an operations layer of its own. It makes sure the rules of the app also hold in day-to-day operation:
- Role-based permissions and separate databases at server level too.
- Changes only through a runner: nobody edits the app by hand. Every change runs as a job through a pull request with tests and review.
- Commands from an allow list only: the server runs released commands, nothing else.
- An emergency stop that halts all automated processes at once.
- Credentials kept apart: credentials live in the password manager, never in the code.
- Encrypted connections with automatically renewed certificates, and login protection against brute force.
- Backups on separate storage and secure deletion with proof.
The EU AI Act: what HIHB is built for, and what it is not
HIHB defines what a role has to deliver. HIHB does not assess, rank or filter applicants. That boundary is a fixed build rule of the app. Decisions about people stay with people.
Continuous compliance with T.R.U.S.S. Compass
An audit on a given date says little about whether an app still meets the rules three months later. So HIHB checks every change before it goes live.
For that, HIHB uses T.R.U.S.S. Compass, powered by Arionkoder. Compass translates the EU AI Act and the GDPR into continuous checks against the code of the app:
- Every change passes the check before it is released.
- A finding becomes a task and is resolved before the change goes live.
- When a rule changes, the code is checked against the new version.
- Compass sees the code and documentation of the app, not customer data.
That keeps the compliance position current, not merely correct on audit day.
Frequently asked questions about data protection, security and AI
Ten questions that come up again and again in conversations with management, IT and data protection officers.
Why do data protection and security start at the operations layer?
A rule in the software protects only as well as the server it runs on. Anyone with direct access to the server bypasses every permission check in the application. That is why nobody at HIHB edits the app by hand: every change runs as a job through a runner, through tests and a pull request. The server runs commands from an allow list only, and an emergency stop halts all automated processes at once.
How do the logical and the technical architecture work together?
Every important rule is implemented twice. Take the separation of customers: logically, the app checks on every request whether the person is assigned to the client. Technically, each client sits in its own database file, which is opened only once that check has passed. If one layer fails, the other holds. This defence in several layers is why application and operations are planned together at HIHB, rather than one after the other.
What is Amazon Bedrock, and why does HIHB use it?
Amazon Bedrock is the Amazon Web Services (AWS) service through which companies use AI models inside their own cloud environment. HIHB uses Claude through it. The difference from going directly to the model provider: AWS runs the model in its own data centres, and the model provider has no access to inputs and outputs (AWS). Bedrock does not use the data for training (AWS). HIHB runs it without storing inputs.
Does the data really stay in the EU?
Yes. HIHB calls Claude through the EU profile of Bedrock. Requests are processed exclusively in EU regions, among them Frankfurt, Paris, Ireland and Stockholm (AWS). The list of these regions is fixed for the profile and does not change. The app itself runs on a server in Germany.
How can it be proven what happened to the data?
Through three logs that complement one another. AWS CloudTrail records every call to the AI, including the region it was processed in, but without content. The app logs every call with its purpose, model and timestamp. And every AI output carries a provenance record of the kind required by Article 50 of the AI Act. Months later it is still possible to show where processing took place and which text came from the model.
What does „without direct personal reference“ mean?
Before a text reaches the AI, the app replaces names with placeholders such as „[Person A]“. The GDPR calls this pseudonymisation. We deliberately write „without direct personal reference“ rather than „anonymous“: an indirect reference, through a role that exists only once in the company for instance, cannot be ruled out sentence by sentence in free text. That is why the processing is secured contractually and technically on top.
How do the anonymous patterns come about, and who benefits?
Out of many sessions the app learns which tasks, goals and skills are typical of a role family. For an entry to become visible, three conditions have to come together: it appears in at least three clients independently of one another, a filter has removed names, figures, companies and job titles, and a human has released it. After thirty days the link to the origin is deleted.
The exchange is small, and it pays off in both directions. What a company gives is a few anonymous lines that cannot be traced back. What it gets is the pattern drawn from many companies for the same role family. Whoever agrees to the anonymous evaluation receives these suggestions and decides case by case whether to adopt one. The more companies take part, the better the suggestions become for everyone.
What is T.R.U.S.S. Compass?
T.R.U.S.S. Compass by Arionkoder translates rulebooks such as the EU AI Act and the GDPR into continuous checks against the code of an AI application (Compass). Compass assigns the system a risk class, derives the resulting obligations and checks every change against them. A finding becomes a task, linked to the change that triggered it. Compass sees code and documentation, not customer data.
Why continuous compliance rather than a one-off audit?
An expert opinion describes the position on one day. The HIHB app is developed further every week, and the rules move with it: the labelling obligations of the AI Act, for example, have applied since August 2026, and guidelines and codes of practice keep being added. A new feature can trigger an obligation that did not exist yesterday. Continuous compliance therefore checks every change before it goes live, and against the current state of the rules. That way the evidence is not correct on audit day alone, but every day.
Does HIHB assess applicants?
No. HIHB defines what a role has to deliver. The app does not assess, rank or filter people. That boundary is a fixed build rule and is checked with every change. Decisions about people stay with people.
Documents on request. We provide the data processing agreement, the technical and organisational measures and the list of sub-processors on request. Alongside them, the privacy notice with purposes, legal bases, retention periods and your rights, and the imprint. We answer questions about a specific project directly: kontakt@hihb.io.