Starred

AI-platform van Starred · host 1 model

AI-platform

Cijfer A · 93%

Starred is a multi-tenant SaaS platform for candidate experience and hiring-team feedback analytics, operated by Starred Group A/S (Copenhagen, DK; CVR 38623508) with platform operations by its Dutch subsidiary Starred B.V. Customers access it via the web application (app.starred.com) and a REST API, with native integrations to ATS systems such as Greenhouse, SmartRecruiters, SAP SuccessFactors, Workday and Lever. It processes personal data as a GDPR Article 28 processor: names, work emails, IP addresses, account metadata and survey/feedback responses of candidates, employees and recruiter users. Hosting and data residency: production runs exclusively in the EU/EEA on AWS eu-west-1 (Ireland) and eu-central-1 (Frankfurt), with application hosting on Vercel (Ireland); the DPA (June 2026) instructs EU/EEA-only processing and prohibits third-country transfers without documented customer instruction. Security: ISO 27001 certified (TÜV), AES-256 encryption at rest on EBS, TLS in transit, GPG-encrypted backups to private S3, MFA and role-based access, segregated management/staging/production networks, third-party penetration testing, annual BCP/DR testing, 24-hour breach notification to controllers. Contractual terms: 30-day advance notice of subprocessor changes, customer-configurable retention, 30-day data export and 90-day deletion after termination (backups purged within 180 days), Danish law and courts. AI: governed by the published AI Addendum (16 June 2026). AI Functionality covers AI Comment Analysis (sentiment and topic classification across 30 languages), the Priority Matrix and Standard Index normalisation models, and a prompt-driven Agent feature. Disclosed model inventory (all cloud-deployed): OpenAI gpt-oss-20b (language processing, summarisation), llama3.1:8b (classification), xlm-roberta-base-sentiment, all-mpnet-base-v2 and multi-qa-mpnet-base-cos-v1 (embeddings), XGBoost (scoring) and SHAP (explainability). Contractual AI safeguards: the service must not be used to evaluate, select or reject candidates or make automated decisions about individuals; Input/Output is never used to train third-party models; only anonymised data reaches AI components, enforced by segregation, identifier suppression and blacklist validation on free-text fields; third-party hosted models (e.g. OpenAI API) are optional and require customer enablement; EU AI Act transparency documentation available on written request. Not public: SLA document, SOC 2 report.