Is Culture Amp safe with your data?

AI does not train on user inputs

Section 8 says Culture Amp integrates third-party LLMs such as Anthropic's Claude and Google's Gemini through AWS or GCP via managed VPCs and an LLM proxy. Section 6(d) limits service-improvement work to de-identified personal information, with no claim that user inputs train Culture Amp's own models.

Full set of data-subject rights

Section 9 names access, correction, deletion, data export in standard CSV format, and the ability to limit or stop use or disclosure, all routed through the Privacy Officer at privacy@cultureamp.com.

Named transfer safeguard and subprocessor list

Section 5(c) commits to European Union Standard Contractual Clauses for transfers to non-adequate countries. The policy links a Subprocessor List and a Data Processing Addendum, backed by signed confidentiality and data processing agreements with service providers.

Vague retention and no breach notice

Section 10 retains data for as long as Culture Amp provides the Services until the Customer requests deletion, with encrypted backups kept up to 90 days. Section 5 names ISO27001 certification but commits to no user breach notification.