Security and data

Hiring involves sensitive information about real people. This page explains how Arku protects it. For the legal detail, see our privacy policy and data processing agreement.

Where your data lives

All Arku customer data is stored in the United Kingdom, in London, whichever country you hire in. That includes organisations and candidates in New Zealand, Australia and the United States.

The companies that help us run Arku are listed on our sub-processors page.

How it is protected

• Every connection to Arku uses HTTPS, and data is encrypted at rest.
• Candidate files are kept in private storage and are never publicly reachable.
• Team members can sign in with two factor authentication or a passkey.
• Each organisation's data is kept separate from every other organisation's.
• Important changes are recorded in an activity log, so you can see who did what.
• Application forms are protected against spam and automated submissions.

Who can see what

Access is set by role. Interviewers can be limited to the jobs they are assigned to, and hiring managers can score candidates through a private link without an account. Sensitive answers, such as salary expectations and background check status, are only shown to people who have been given permission to see them. They are removed before the page is sent, not just hidden.

What we never collect

• Application forms cannot ask for bank details, passport numbers or other government identity numbers.
• Arku records only the status and date of a background check. It never stores or accepts the check itself.
• Arku never ranks, scores or rejects candidates automatically, and its AI features never read candidate applications.

Retention, export and erasure

You choose how long to keep candidate data (the Free plan keeps it for six months after a candidate's last activity). When that time is up, Arku removes personal details and files automatically and keeps only anonymous figures for your reports. You can export everything about a candidate, or erase them straight away, when they ask.

Text message consent

Where the law requires it, including for candidates in New Zealand and the United States, Arku will not send a text until the candidate has opted in on the apply form.

Report a security issue

If you think you have found a vulnerability, email security@arkuhq.com. Please give us a reasonable chance to fix it before telling anyone else. We will reply within two working days.