How CLEAR Talent protects your employee data
Ratings, written feedback and development notes are some of the most sensitive records an organisation keeps about its people. This page sets out how CLEAR Talent handles them — GDPR tooling, hosting, the DPA, encryption, access, sign-in and AI — and says just as plainly where the answer has to come from a conversation rather than a web page.
A security review for performance software usually starts with the same questionnaire: where the data lives, who can see it, how it is protected in transit, how a subject access request is answered, what the AI does with it and what happens when the contract ends. The sections below answer each of those in the order your DPO and IT team are likely to ask them.
CLEAR Talent holds performance and development data — goals, competency assessments, reviews, feedback and development plans — not payroll, bank details or customer data. That narrows the review, but it does not make it a formality, and nothing here replaces the documents your procurement process will ask for in writing.
GDPR
Data-rights tooling built into the platform.
Your organisation is the controller of its employees’ performance data; CLEAR Talent processes it on your behalf. These are the controls the platform provides for the parts of a GDPR programme that touch that data.
Subject access request exports
When an employee asks for a copy of their data, HR can answer the DSAR from the platform with an export, rather than searching review forms, inboxes and spreadsheets by hand.
Right-to-be-forgotten workflows
Erasure requests are handled through a defined workflow, so they are dealt with consistently rather than depending on who happens to pick them up.
Consent and access logged
Consent records, sign-ins, exports, approvals and rating changes are logged against the user responsible, with before-and-after values on every change.
Your records, exportable on every plan
Every plan includes export to CSV, Excel and PDF, so the performance record is never held hostage by the tool that stores it.
Compliance also depends on how you configure and use the platform — lawful basis, retention policy and who is given which role are your decisions — so your DPO should review the DPA and the settings as part of the evaluation.
Hosting & data residency
Where employee data lives.
CLEAR Talent runs on Google Cloud Platform enterprise infrastructure, whose global data centres support localised storage and regional compliance requirements.
Google Cloud Platform infrastructure
The platform is hosted on Google Cloud Platform, with continuous infrastructure scanning and real-time alerting through GCP Security Command Center Premium.
Regional requirements agreed per deployment
If your organisation needs employee data held in a particular region, such as the EU, raise it at the start of the conversation. Regional requirements are agreed with the team for each deployment.
Get the hosting region confirmed in writing alongside the DPA rather than taking it from a web page — including this one.
DPA & subprocessors
The processor relationship, documented before any data is loaded.
A data processing agreement is available, so the terms on which CLEAR Talent processes your employees’ data are agreed before the first record goes in.
Data processing agreement
Request the DPA from the team and have your DPO or counsel review it during the evaluation, not after the contract is signed.
Subprocessors
The infrastructure provider that hosts the platform is listed below. Ask for the complete, current subprocessor list — with the purpose and location of each — alongside the DPA, and check it against your own register.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Application hosting, infrastructure and threat monitoring | Region agreed per deployment |
Encryption & access control
Protected in transit, limited by role, logged throughout.
Security is layered: encryption on every connection, permissions kept to the minimum, short-lived file links and an audit trail behind every change.
TLS on all data in transit
All data in transit is encrypted with TLS — including traffic between internal services, caching and the API — so there are no unencrypted pathways.
Signed links that expire after 24 hours
Documents, profile files and exports are served through signed URLs that expire after 24 hours, so a forwarded or leaked link stops working on its own.
Role-based access with ownership checks
Administrators, managers and employees each work within what their role allows, and access to an individual record is checked against who owns it. Managers work within their own reporting line.
Least-privilege infrastructure
Every service, pipeline and storage bucket operates with only the permissions it needs, which limits what any single compromised component could reach.
Audit logging on every change
Logins, database operations and data changes are recorded with a timestamp and user identity, so you can show who changed a rating, when and from what.
A+ Mozilla Observatory rating
The platform holds an A+ rating from Mozilla Observatory, an independent check of web security headers and configuration that anyone can rerun.
Sign-in & SSO
How people sign in — and what is not available today.
Identity-provider integration is the question IT teams ask first, so here is the straight answer.
CLEAR Talent credentials
People sign in with their own CLEAR Talent credentials, and what they can see once signed in is governed by their role and the ownership checks above.
Biometric sign-in on mobile
The native iOS and Android apps support biometric sign-in, so employees completing reviews on a phone are not relying on a remembered password.
No SAML SSO or SCIM today
CLEAR Talent does not currently offer SAML single sign-on through an identity provider such as Microsoft Entra ID, Okta or Google Workspace, and there is no SCIM provisioning. If your IT policy requires SSO for every business application, raise it before you shortlist.
Backup & retention
Keeping the record intact, and letting it go when it should.
A performance record has to survive an incident and be deletable on request. These are the parts the platform handles today.
Closed cycles stay closed
Each review stage opens and closes on the dates you set, so a rating cannot be quietly amended after the cycle ends — and the audit log records every change made while it was open.
Erasure when it is due
Right-to-be-forgotten workflows let HR remove an individual’s data consistently when an erasure request or your own retention policy requires it.
Your data back when you leave
Export to CSV, Excel and PDF is included on every plan, so you can take a complete copy of your records out before a contract ends.
Backup frequency, how long backups are kept, recovery objectives and how soon data is deleted after a contract ends belong in your contract. Ask for them in writing during the evaluation.
AI governance
What Ava does with employee data — and what she never does.
Ava, the AI assistant built into CLEAR Talent, drafts review narratives from the evidence already in the platform and summarises 360° feedback. The manager writes and owns the review. The EU AI Act treats AI used to evaluate workers’ performance as high-risk, and Ava was designed around the oversight, transparency and record-keeping that implies.
Works from your evidence
Ava reads the goal scores, competency ratings, 360° feedback and check-in notes already recorded for an employee in the platform and turns them into a first-draft review narrative for the manager to work from.
Never trains a shared model
Ava runs on isolated tenants, and your employees’ data is never used to train models for other customers.
A human decides, every time
Every Ava output is labelled as AI-generated, editable and approved by a person. Ava never makes the final rating; managers accept, amend or reject her drafts, and every edit is logged.
Switch it off where you need to
AI can be turned off per cycle, per team or per module — useful when a works council, a union agreement or your own policy calls for a process without it.
CLEAR Talent does not certify your compliance with the EU AI Act. The team will work through the specifics of your deployment with your compliance function.
Certifications & audits
Ask for the evidence your procurement process requires.
Security questionnaires often ask for a specific certification or third-party audit report. Ask for it by name at the start of the evaluation and you will get a plain answer about what can be provided.
Security questionnaires
Send your standard questionnaire through the contact form and the team will work through it with you, alongside the DPA and the subprocessor list.
Security and privacy questions
What DPOs and IT teams ask first.
Short answers to the questions that decide whether a performance platform passes the security review.