Data processing agreement

Version 1.6, last updated 20 October 2026

Overview

This page summarises Mentum's Data Processing Agreement (the "DPA") for employer customers. The DPA is the contractual basis on which Mentum processes personal data on your behalf when you use the Mentum platform to post jobs, review matched candidates, record hiring decisions, and collaborate with your team.

The DPA applies in addition to our Terms of Service and is structured to satisfy the requirements of UK GDPR Article 28, the EU Standard Contractual Clauses (Module Two, 2021/914), and the UK International Data Transfer Addendum.

How to execute the DPA

A company owner accepts DPA 1.6 in Settings, under Right to work and DBS records, before right-to-work or DBS records can be kept. For DBS, the owner also records the organisation's Schedule 1 condition and confirms any required policy document. We keep who accepted, when and which version. Owners can turn either record type off again in Settings, and existing records stay readable. You can also request a signable copy:

Email privacy@mentumjobs.com with the subject line "DPA request".
Include your organisation's legal name, registered address, authorised signatory, and contact email for data-protection notices.
We'll send you a signable PDF.

This page is a summary. Request the complete agreement using the contact above before accepting if you need a copy.

Key clauses at a glance

Roles

You (the employer) are the data controller for the personal data you submit to Mentum through your team's use of the platform. Mentum is the data processor for that data. Candidates registering directly with Mentum have a separate controller relationship with Mentum governed by our Privacy Policy.

What data the employer feeds in

Job postings (titles, descriptions, salary, location, skills)
Match decisions and rejection reasons (including any free-text notes you record)
Interview feedback (rubric scores, notes, hire recommendations)
Employer team membership and internal comments on candidate matches
Company profile information (description, website, logo, founding year, mission, HQ location, industry, employee count)

The agreement also covers employer-recorded right-to-work and DBS checks (including clear results), offer letters and signature evidence, and requested documents. Criminal-record certificates must not be uploaded. Equality reports contain grouped figures with small groups withheld, and individual equality answers remain private. Check records become due for deletion 6 months after the hiring process for the job ends. Passed right-to-work checks are kept until 30 days after expiry if that is later. An online share code is deleted as soon as the check is settled, or after 30 days if it never is. Employers keep their statutory evidence separately.

Mentum's core obligations

Process the data only on your documented instructions (Article 28(3)(a))
Maintain confidentiality undertakings (Article 28(3)(b))
Implement the technical and organisational measures described in Annex II (Articles 28(3)(c) and 32)
Notify you of any new sub-processor at least 30 days before engagement, with your right to object (Article 28(3)(d))
Assist you in responding to data-subject-rights requests (Article 28(3)(e))
Notify you of any personal data breach within 72 hours of becoming aware (Article 28(3)(f) and Article 33)
Make available the compliance evidence you reasonably need to assess our processing (Article 28(3)(h))
Return or delete your personal data on termination, save for the backup residual disclosed in section 13.9 of the DPA

Sub-processors

The full list of sub-processors is in Annex III of the DPA. The principal sub-processors are:

Supabase Inc. (database, authentication, storage, real-time)
Google LLC (Gemini for embeddings, skill estimation, reading scanned CV files, and as the fallback for standard AI processing)
OpenAI (GPT-6 Luna and GPT-5.6 Luna through the Responses API and Batch API: standard AI processing, including CV parsing, job-description extraction and match explanations, and the premium Career Adviser, interview practice, insights, CV optimisation, career recommendations and trajectory, hiring advice and job-description generation)
Twilio SendGrid (transactional and lifecycle email)
Railway Corp (API and frontend hosting, including server-side rendering and its session cookies, and managed Redis)
GitHub, Inc. (source code and CI/CD)
Functional Software, Inc. (Sentry) (error tracking)
Plus an optional Redis cache provider, an open-source malware scanner, and inbound feed data from Adzuna Ltd.

See the public sub-processor list for the current list and to subscribe to notifications.

OpenAI doesn't use our API data to train its models, and we haven't opted in to that. We ask OpenAI not to store responses, but it may still keep some data for a limited time under its own terms, so we don't claim it keeps nothing. OpenAI's data processing agreement and transfer terms for our production account will be in place before real candidate data is sent to it.

International transfers

Some sub-processors host data in the United States. Where personal data is transferred outside the UK, the DPA incorporates the EU Standard Contractual Clauses (Module Two, 2021/914) together with the UK International Data Transfer Addendum, signed automatically on execution of the DPA.

Security commitments

Encryption at rest (AES-256, managed by Supabase) and in transit (TLS 1.2 or higher with HSTS preload)
Row-level security switched on for every public table, and no user access to server-only tables
Three-client database access isolation (service-role, per-request user, anonymous)
Dual JWT verification path (HS256 + ES256 with JWKS) and an algorithm-confusion-proof validator
Adversarial test suite covering eleven in-repo attack surfaces (Schemathesis fuzz, OWASP ZAP, AI red-team, race-condition chaos, IDOR, uploads, auth enumeration, SSRF, CSV injection, frontend monkey, webhook authenticity). These are our own automated tests, not an independent penetration test.
72-hour breach notification commitment. An automated check every 5 minutes for login brute-force and mass-access patterns. It detects only those patterns.
A recovery time target of 4 hours and a recovery point target of 5 minutes. These depend on vendor capability and haven't been validated by a full restore drill. See the SLA § 5.

Annex II of the DPA lists the technical and organisational measures with their source-code citations.

Honest disclosures

Mentum is a single-developer pre-launch organisation. The DPA discloses this and the resulting accepted residuals (no segregation of duties, no formal training programme, no workstation MDM) with documented trigger conditions to revisit on headcount growth. The DPA also discloses:

The Supabase backup restore drill has been documented but not yet executed end-to-end (deferred pending a paid staging environment).
Two sub-processor agreements are still to be signed: Railway's DPA and the formal Supabase UK GDPR addendum. Both agreements will name the new company and will be signed after incorporation, before any production Customer Personal Data reaches them. The vendor details for Jooble are still being checked, and OpenAI's production-account terms are evidenced before activation. The Google Cloud, Twilio SendGrid and Sentry DPAs are in effect.
2-step verification is required for admin and careers-adviser accounts and optional for everyone else. Admin sessions end after 4 hours and sensitive admin actions ask for a one-time code again.

Full text

The complete DPA includes Annex I (subject matter, categories and retention), Annex II (technical and organisational measures with source-code citations), Annex III (sub-processor list) and Annex IV (open privacy items disclosed to the controller). It is maintained in version control at docs/legal/dpa.md in the Mentum source repository and is available as a signable PDF on request.

For audit access to the source-code references cited in Annex II, contact privacy@mentumjobs.com.

Contact

Privacy and DPA requests: privacy@mentumjobs.com
Privacy contact: dpo@mentumjobs.com

← Back to Legal