Book a demoDemo

Security & trust · hosted in France · GDPR compliant Hosted in Paris.
Walled off by firm.

Marvin hosts your data in France, with Scaleway in Paris. Traffic encrypted with TLS, secrets encrypted with AES-256-GCM, strict isolation per firm, role-based permissions and a daily backup in France. GDPR is in the contract: the data processing agreement and the list of sub-processors are in the Trust Pack.

Book a demoGet the Trust Pack
The architecture · from your browser to the backupOverview
app.marvins.ai
Camille RousseauAccountant · Paris

Sign-in

Your browserDemo, fictitious profile.

TLSencrypted in transit
Scaleway · Parisfr-par region · France
Containerised infrastructureautomatic security updates
Secrets and sign-in tokensencrypted with AES-256-GCM
Your firmyour records, CVs and notes

Who sees what

Manager
every record, plus the settings
User
every record
Restricted by team
their team's records
Restricted
their own records, and those shared with them
Custom
set by the manager
Another firmno cross-access
Another firmno cross-access
Automatic backupevery day · hosted in France
The team's actions stay in the record's history.Subprocessors, AI providers included: listed in the DPA.

What we do

Eight points, in black and white.
Nothing more, nothing vague.

  • Your data is hosted in France.

    Scaleway, Parisfr-par region. Our subprocessors, AI providers included, are listed in our DPA.

  • GDPR is in the contract, not in a slogan.

    GDPR complianceThe data processing agreement (article 28) is part of the Trust Pack.

  • What travels is encrypted. So is what opens access.

    TLS and AES-256-GCMTraffic encrypted with TLS. Secrets and tokens encrypted with AES-256-GCM.

  • A firm never sees another firm's data.

    Data isolationMulti-tenant architecture with strict isolation, per firm.

Traceability

Who did what, and when.
On every record.

The record's history keeps the team's actions, with their author and time. And everyone only sees the records their role opens to them.

History · Camille Rousseau

  1. Sophie Martin moved the application to the Client interview stage

    Accountant process · Orvane Consulting

  2. Thomas Dupont added an interview note

    “Available in November, one month's notice.”

  3. Sophie Martin sent a WhatsApp message

    “Hi Camille, are you free on Thursday?”
Demo, fictitious profiles.

  • One backup every day, in France.

    Daily backupsAutomatic. Recovery commitments are detailed in the continuity plan in the Trust Pack.

  • A target availability of 99.5%.

    Continuous monitoringAutomatic alerts. A contractual commitment (SLA) is available on quote.

  • Everyone sees what their role allows. No more.

    Access controlRole-based permissions. With Google or Microsoft, your identity provider's two-factor authentication applies. Action history on every record.

  • Security updates don't wait for you.

    InfrastructureContainerised, with automatic security updates.
ParisScaleway, fr-par region

Where your records, CVs and backups live.

99.5%target availability

Contractual SLA available on quote.

1 / dayautomatic backup

Hosted in France.

6documents in the Trust Pack

Your legal team's file, ready to go.

And the AI?

The AI reads your data.
It doesn't learn from it.

The question every firm asks, and our answer, backed by the contract.

  • Your data trains no model.Marvin does not use your data to train AI models.
  • Providers under contract, and named.CV reading, Copilot: processing goes through providers listed in our DPA, on API plans that exclude training by default. The AI system card is part of the Trust Pack. Responsible AI
  • Your own key, if you prefer.You can plug in your own AI key. And through the MCP server, the AI runs in your own assistant. MCP server
Camille Rousseau's CVuploaded to the record
AI providerunder contract, listed in the DPAAPI offer · training excluded by default
Camille Rousseau
Role
Accountant
Skills
SAP, Sage, Excel
Experience
6 years
read from the CV
Training a model on your dataNo. Marvin doesn't, and its providers work on offers that exclude it by default.
AI key: Marvin's, or your own.Demo, fictitious profile.

Trust Pack

The file your legal team will ask for.
It's ready.

The one we hand to our clients' legal and security teams. A team member sends it to you after your request: it's a contractual document, it doesn't go out on its own.

  • DPAData processing agreement (DPA, GDPR article 28)
  • Annex BList of sub-processors
  • Annex CAI providers and AI system card
  • TOMsTechnical and organisational measures
  • BCP / DRPBusiness continuity and disaster recovery plan
  • White paperSecurity white paper and GDPR FAQ

Get the Trust Pack

Reply by email, from a member of the team.

Marvin Recruiter protects your data. By sending this form, you agree to our privacy policy.

Frequently asked questions

What legal teams ask.

Where does Marvin host its clients' data?

Marvin hosts data in France, with Scaleway, in the fr-par region (Paris). The daily backups are hosted in France too. Marvin is a French company subject to GDPR: the data processing agreement (article 28) is part of the Trust Pack. You remain the owner of your data and can export it at any time.

Who are Marvin's subprocessors, AI providers included?

They're listed in Marvin's DPA, AI providers included. The list of sub-processors and the AI system card are part of the Trust Pack.

Does Marvin offer an availability commitment (SLA)?

Target availability is 99.5%, with continuous monitoring and automatic alerts. A contractual commitment (SLA) is available on quote.

Where is our data handled during a migration to Marvin?

During a migration, your exports are handled by Marvin's data team on storage hosted in France. How the migration works

Security, on paper.
The product, on your data.30 minutes with a sample of your data, and your security questions answered live.

Book a demo

Updated