Security & GDPR

Trust is the whole product

Data protection by design: we collect as little as possible, only show it with consent and delete it when its purpose has been fulfilled.

The candidate is in control

A passport is always created by the candidates themselves. We never contact a manager unless the candidate asks us to.
The candidate chooses which references to share and can close a company's access at once.
The account and all data can be deleted with one click.

Reports are only shown in the browser. Download and printing are disabled.
Every view carries a watermark with the company's name and the time, and is logged.
Access expires after 6 months, and the view log is deleted.

Five ratings from 1–5 (three fixed and two that fit the job), a ranking among colleagues, yes/no to rehiring, three short choices about working style and up to three strengths – all from fixed lists.
Mostly fixed choices. The manager may optionally write a few sentences (max 600 characters) and a short development note – and is asked never to write about health, absence or private life.

The manager confirms their work email with a code. Private and temporary email addresses are rejected.
We check that the email domain actually belongs to the company – via the Danish CVR register, the age of the domain and the company's website.
Candidates confirm their identity with MitID – one MitID can only confirm one passport, and the name is locked. Managers can confirm with MitID Erhverv.

Encrypted database and servers in the EU (Stockholm). All traffic is encrypted with TLS.
Row-level access control: users can only see their own data.
Links are only stored as cryptographic fingerprints. Payments go through Stripe – we never see card details.

Referencepas is the independent data controller for the passport, so companies viewing a passport do not need a data processing agreement. If you invite candidates through Referencepas or the API, we process name and email on your behalf – this is covered by our data processing agreement, which you can request from us. Invitations are deleted after 6 months.
You have the right to access, rectification and erasure – also as a manager who has given a reference.
We never sell data and do not use it to train AI. See all our data processors and their agreements at referencepas.dk/en/data-processors.
You can always lodge a complaint with the Danish Data Protection Agency (Datatilsynet).