How we protect your data — and the people behind it.

Your account and assessment data are stored on single-tenant servers in Helsinki, Finland (Hetzner), within the EU. Reference data (occupation taxonomies) is non-personal. Nightly backups are encrypted and stored separately.

We deliberately run our own dedicated infrastructure rather than a shared multi-tenant cloud, with strict network isolation and firewalling.

• In transit: TLS 1.2+ on every connection, including to our databases (Cloudflare Full-strict).
• Backups: encrypted at rest and stored off-site, and proven recoverable through a live restore drill.
• At rest (primary volume): encryption of the live database volume is being rolled out; until then, access is protected by network isolation, least-privilege controls, and the encrypted-backup layer.
• Access: least-privilege controls; administrative access only over secured, non-public channels.
• Monitoring & response: continuous monitoring, off-site log aggregation, external uptime checks, and a documented incident-response runbook.

We publish what's true, including what we're still improving — because a security page you can't trust is worse than none.

These are internal reliability targets, not a contractual SLA:

• Uptime: 99.5% / month target.
• Data loss (RPO): ≤ 24 hours — matched to our nightly, tested backups.
• Recovery (RTO): ≤ 30 minutes for a service-level incident (measured on a real incident).

A small, vetted set of providers helps us run NexPath. Each is bound by a data-processing agreement and processes data only on our instructions. We notify customers of material changes.

Your assessment is scored by a deterministic, rule-based engine — the calculations that produce your profile and career matches are mathematics, not AI. We use AI only to (1) phrase the already-computed results in readable language, and (2) power the counselor assistant over a participant's completed profile plus open career information.

The AI never performs or alters the scoring, and it works from qualitative profile information rather than raw numeric scores. We are actively minimizing the personal data included in AI requests.

• For users under 16, we require verifiable parental consent — or, where a school is the data controller, the school's authorization — before assessment data is processed (GDPR Art. 8).
• If parental consent is requested but not confirmed within 7 days, the account and its data are automatically deleted.
• We measure only career interests and personality — no special-category data.

You can export your data in a machine-readable format, and delete your account at any time. Deletion is permanent and irreversible across our systems, including our authentication provider — not a soft-delete. Full details are in the Privacy Policy.