Lever and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. AI features are off until the customer enables them, and Employ may train models on a customer's AI input data only if the customer instructs, directs or consents, and then only on an anonymized or aggregated basis.

Vendor's wording: “If Customer instructs, directs, or consents to the use of its Input Data in training or fine-tuning AI or to its being shared with third parties (Training), Employ has a limited license to use such Input Data on an anonymized and/or aggregated basis”

Source: employinc.com4. AI TermsChecked on 19 October 2026

United States. The sub-processor list gives AWS (cloud hosting and infrastructure) and Google Cloud (cloud hosting) as USA.

Vendor's wording: “Amazon Web Services (AWS) Cloud Hosting & Infrastructure USA”

Source: employinc.comCurrent List of Lever Sub-ProcessorsChecked on 19 October 2026

DPA on request.

Yes. A GDPR/UK/Swiss DPA with standard contractual clauses is published; Employ acts as processor. Employ also offers a pre-signed DPA for download.

Vendor's wording: “Customer appoints Employ as a processor to process Customer Data on behalf of, and in accordance with, Customer’s instructions as set out in the Agreement and this Addendum”

Source: lever.co2.3 Customer InstructionsChecked on 19 October 2026

Published.

Yes, public at https://www.employinc.com/sub-processors/: 17 current Lever sub-processors, plus 3 optional ones (Employ, Nylas, Workato) and 3 affiliates. The separate AI Companions list (9) names Anthropic, OpenAI, AssemblyAI, IBM watsonx and Recall.

Vendor's wording: “This article communicates the current list of companies who are authorized to process personal data for the Lever software.”

Source: employinc.comAuthorized Sub-Processors for Lever SoftwareChecked on 19 October 2026

Parent company listed.

Not listed under its own name (Lever); its parent Employ Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Employ Inc'Checked on 19 October 2026

Customers configure their own retention and automatic anonymisation or deletion rules in the product. Employ deletes customer data from production 30 days after contract end, fully deleted by 45 days.

Vendor's wording: “Employ initiates the deletion of all Customer data from the production systems 30 days following contract termination so that such data is deleted by 45 days after contract termination.”

Source: lever.coAnnex II: data retentionChecked on 19 October 2026

1 named: SOC 2 (the security exhibit commits Lever to maintain AICPA SOC 2 certification or equivalent; the pricing page says SOC 2 Type II). No ISO certificate found.

Vendor's wording: “Lever shall maintain AICPA SOC2 certification or equivalent as well as maintain a lawful transfer mechanism for export of personal data out of the European Union.”

Source: lever.co1.2 CertificationChecked on 19 October 2026

Yes. AI functionality does not process customer data until the customer's authorized users enable it, and the customer is responsible for controlling who can enable it.

Vendor's wording: “Customer is responsible for managing and monitoring access to the AI and for ensuring that only appropriately authorized individuals enable such functionality.”

Source: employinc.com4. AI TermsChecked on 19 October 2026