Confidentiality is part of the search architecture

Evense processes personal data in accordance with the General Data Protection Regulation (GDPR) and applies data protection by design and by default.

The principles we apply

• Purpose limitation: information is used for a defined search, advisory, relationship or legal purpose.
• Data minimisation: we use only the information relevant to that purpose.
• Access control: confidential information is available only to authorised people who need it for their role.
• Retention discipline: information is retained according to an approved schedule and deleted or anonymised when it is no longer required.
• Accuracy and accountability: material information can be corrected, and responsibility for its use remains with Evense.
• Human responsibility: technology may support the work; it does not make an autonomous appointment, selection or rejection decision.

A controlled local intelligence layer

Where AI is used with sensitive client or candidate material, our architecture routes that work through an enterprise-controlled, locally hosted small language model (SLM) environment. This local layer is designed to keep confidential content inside approved Evense infrastructure and to support tasks such as organising authorised information, controlled retrieval and quality checks.

Controlled use of frontier models

Frontier models can add value for bounded tasks that benefit from broader language or reasoning capability. Evense's policy is to use them selectively through an approved enterprise or API configuration and only after the data has been classified.

Sensitive identifying content must not be sent to an external frontier model. When an approved task can be performed externally, the input is reduced to the minimum necessary and anonymised wherever possible. Pseudonymised context may be used only under an approved exception and remains personal data subject to GDPR controls.

How information is routed

We classify the information and the purpose of the task; keep sensitive work local within the approved Evense-controlled environment; remove or replace identifiers before any permitted external model call; use an approved model for a defined task with the smallest useful context; review the result for accuracy, bias, confidentiality and relevance; and record material use so that responsibility and decisions remain traceable.

No model output becomes a candidate judgement, client recommendation or published fact without appropriate senior review.

For clients

Client strategy, mandate details, organisational information, market hypotheses and assignment material are handled according to their sensitivity. Access within the client environment is role-based and auditable. Public screenshots use synthetic data and do not expose the underlying application, live assignments or identities.

For candidates

Candidate information is used only for defined purposes and shared according to the relevant process, legal basis and privacy notice. Candidates are told what information is required, why it is used, when it may be shared, how long it is kept and how to exercise their data rights — see our Privacy Notice.

Governance before claims

This page explains our intended operating standard. As a Beta page, it is published for review rather than as a final, legally validated statement: Evense is working to evidence the controls behind each statement above. A local model alone does not establish GDPR compliance or prevent every possible disclosure; compliance depends on the full legal, organisational and technical system.