How we protect your data — and the people behind it.

Your account and assessment data are stored on single-tenant servers in Helsinki, Finland (Hetzner), within the EU. Reference data (occupation taxonomies) is non-personal. Nightly backups are encrypted and stored separately.

We deliberately run our own dedicated infrastructure rather than a shared multi-tenant cloud, with strict network isolation and firewalling.

• In transit: TLS 1.2+ on every connection, including to our databases (Cloudflare Full-strict).
• Backups: encrypted at rest and stored off-site, and proven recoverable through a live restore drill.
• At rest (primary volume): encryption of the live database volume is being rolled out; until then, access is protected by network isolation, least-privilege controls, and the encrypted-backup layer.
• Access: least-privilege controls; administrative access only over secured, non-public channels.
• Monitoring & response: continuous monitoring, off-site log aggregation, external uptime checks, and a documented incident-response runbook.

We publish what's true, including what we're still improving — because a security page you can't trust is worse than none.

These are internal reliability targets, not a contractual SLA:

• Uptime: 99.5% / month target.
• Data loss (RPO): ≤ 24 hours — matched to our nightly, tested backups.
• Recovery (RTO): ≤ 30 minutes for a service-level incident (measured on a real incident).

A small, vetted set of providers helps us run NexPath. Each is bound by a data-processing agreement and processes data only on our instructions. We notify customers of material changes.

Your assessment is scored by a deterministic, rule-based engine — the calculations that produce your profile and career matches are mathematics, not AI. We use AI only to (1) phrase the already-computed results in readable language, and (2) power the counselor assistant over a participant's completed profile plus open career information.

The AI never performs or alters the scoring — it works from the results the engine has already computed. Before a request leaves our systems, direct identifiers are removed: name, email address and username. We continue to minimize the personal data included in AI requests.

• For users under 16, we require verifiable parental consent — or, where a school is the data controller, the school's authorization — before assessment data is processed (GDPR Art. 8).
• If parental consent is requested but not confirmed within 7 days, the account and its data are automatically deleted.
• We measure only career interests and personality — no special-category data.

You can export your data in a machine-readable format, and delete your account at any time. Deletion is permanent and irreversible across our systems, including our authentication provider — not a soft-delete. Full details are in the Privacy Policy.