Greenhouse Recruiting and the GDPR: AI training, data location and DPA

Trains on your data in part.

Partly. Greenhouse may use AI inputs and outputs, only in anonymized, de-identified form, to improve and train its own machine-learning models; it says it will not use Personal Data to train models. Its third-party AI providers are barred from training on customer data.

Vendor's wording: “Notwithstanding the foregoing, Greenhouse will not use Personal Data to train machine learning models.”

Source: greenhouse.com5. Improving AI Features; 6(c) No Third-Party TrainingSecond source: greenhouse.comChecked on 19 October 2026

DPA on request.

Yes. A standard DPA is published and is incorporated into the Master Subscription Agreement; Greenhouse is the processor. It is a form the customer completes and signs.

Vendor's wording: “THIS DATA PROCESSING ADDENDUM (“DPA”) is incorporated into, and is subject to the terms and conditions of, the Master Subscription Agreement or other written or electronic agreement”

Source: greenhouse.comPreambleChecked on 19 October 2026

Published.

Yes, public at https://www.greenhouse.com/subprocessors-in-use: 30 rows (28 companies; Google appears 3 times). AI providers: Anthropic PBC and OpenAI OpCo, LLC (hosting large language models), Glean (internal AI), Recall.ai (transcription).

Vendor's wording: “Service provider for hosting large language models. Uses include AI product features and internal operational support purposes”

Source: greenhouse.comName of Subprocessor tableChecked on 19 October 2026

On the list.

Active (Greenhouse Software Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Greenhouse Software'Checked on 19 October 2026

Customer sets its own retention rules in the app and can delete data at any time. All personal data is deleted automatically 90 days after the contract ends (or earlier on request); deleted data stays in backups for up to 30 days.

Vendor's wording: “All personal data in Controller’s account is automatically deleted ninety (90) days following expiration or termination of the services agreement, or earlier upon Controller request”

Source: greenhouse.comAnnex II: Measures for ensuring limited data retentionChecked on 19 October 2026

5 named: ISO 27001:2022, ISO 27701:2019, ISO 42001:2023, SOC 1 Type 2, SOC 2 Type 2 (annual audits).

Vendor's wording: “Certified for ISO 27001:2022, ISO 27701:2019 and ISO 42001:2023”

Source: greenhouse.comGlobal compliance standardsChecked on 19 October 2026

Yes. Customers can enable or disable any AI feature at the organisation level.

Vendor's wording: “Customers can enable or disable any AI feature at the org level.”

Source: greenhouse.comFAQ: Is AI recruiting software secure and compliant?Checked on 19 October 2026