Workable Recruiting + HR and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes, per Workable's AI page: its AI tools are trained on feedback from user interactions and it says it uses customers' data to improve its in-house AI. The terms add that Workable can use aggregated data without identifying details to improve the Services.

Vendor's wording: “Our focus is to use customers' data to enhance the performance and accuracy of our in-house AI systems.”

Source: workable.comFAQ: How is Workable different from tools like ChatGPT or Claude?Checked on 19 October 2026

United States. The services are hosted and operated in the US through Workable, Inc. and its providers; hosting is in AWS US East and Google Cloud US East.

Vendor's wording: “The Services are hosted and operated in the United States (“U.S.”) through Workable, Inc. and its service providers”

Source: workable.comInternational transfers sectionChecked on 19 October 2026

DPA on request.

Yes. The Data Processing Addendum is incorporated into the terms of use automatically; Workable is processor. A separately signed DPA or quote terms would override it.

Vendor's wording: “This Data Processing Addendum (“Addendum”) is incorporated into the agreement(s) between the customer (“Customer” or “Controller”) and the Workable entity contracting with the Customer”

Source: workable.comPreambleChecked on 19 October 2026

Published.

Yes, public at https://www.workable.com/subprocessors (updated 18 June 2026): 25 sub-processors plus 3 Workable affiliates. AI-related: OpenAI, Microsoft Azure (model inference), LangChain (orchestration), Deepgram (transcription), Google Cloud (Gemini for CV parsing).

Vendor's wording: “Microsoft Azure United States To provide AI model inference services.”

Source: workable.comWorkable sub-processors tableChecked on 19 October 2026

On the list.

Active (Workable Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Workable'Checked on 19 October 2026

Kept while the account is active; the customer can delete candidate data itself. After the services end, Workable may delete all personal data at any time after 90 days. Deletion requests from candidates are handled within 30 days.

Vendor's wording: “Where the Controller has not deleted the personal data prior to the termination of the Services, Processor may delete all personal data at any time after 90 days following the date of termination”

Source: workable.comReturn or deletion of dataChecked on 19 October 2026

4 named: ISO/IEC 27001, ISO/IEC 27017, SOC 2 (Type II, on request), SOC 3. Workable Agent page also cites the three first.

Vendor's wording: “SOC 2 (Type II) Trust Services Principles Contact us for access”

Source: workable.comWorkable protects your data at every levelChecked on 19 October 2026

Yes for the Workable Agent: an admin kill switch disables it across the whole account, and settings can be set per account, job or candidate. The terms call the AI-powered features optional.

Vendor's wording: “Disable the Agent across your entire account at any time.”

Source: workable.comYou stay in control: Admin kill switchChecked on 19 October 2026