The Challenge
GUT Personalmanagement (GUT), based in Munich, works in one of the most data-sensitive fields there is: HR and staffing. Their daily business runs through inboxes — applications with CVs attached, staffing requests from clients, follow-ups and clarifications. Every email contains personal data of real people: names, addresses, work histories, qualifications.
Turning an inbound email into a placed candidate was a multi-step manual process: triage the mailbox, extract the CV, build a structured profile, match it against open requests, write a client-ready summary, send it. Then repeat, dozens of times a day.
The obvious fix — wiring a standard LLM API into the pipeline — creates a new problem. Candidate data is sensitive personal data under GDPR, and AI systems used in employment and worker selection fall into the EU AI Act’s high-risk category. Sending plaintext CVs to a third-party AI provider was not an option GUT was willing to take.
Why NOMYO AI
GUT chose NOMYO AI for two complementary reasons: a purpose-built matching and automation platform covering their entire workflow, and the E2EE Secure Inference Service that powers its AI steps without ever exposing candidate data.
One Platform, From Inbox to Client Profile
NOMYO built GUT a custom matching and automation platform that covers the entire path from an incoming email to a sent, anonymized candidate profile:
- Automated mail triage — the platform polls GUT’s mailboxes (Microsoft Graph for Outlook, IMAP as fallback), turns every application and staffing request into a case, and classifies it with AI. Anything the AI can’t confidently classify lands on a clarification list instead of silently disappearing
- AI parsing with provenance — CVs (PDF, DOCX) are parsed into structured candidate profiles. Every field records its origin — AI or human — plus a confidence level, and every field remains manually correctable
- Explainable matching — every match gets a 0–100 score with a traffic-light rating, three to six plain-language reasons, and an explicit list of gaps (“work permit needs clarification”). The explanations are rule-based, not AI-generated, so “why this match?” is always verifiable
- Anonymized client profiles — one-click generation of a one-page profile that strips all direct identifiers, protected by an automated residual-PII check; a profile that fails the check is hard-blocked from sending
E2EE Secure Inference for Sensitive HR Data
The platform’s AI steps — mail categorization, CV parsing, request extraction — run through NOMYO’s E2EE Secure Inference Service via the nomyo SDK. The difference to a standard AI API is fundamental:
- End-to-end encryption — prompts and responses are encrypted with AES-256-GCM before they leave GUT’s infrastructure, with RSA-OAEP-4096 handling the key exchange. Candidate data never reaches the AI provider in plaintext
- Forward secrecy — every request uses ephemeral encryption keys that are destroyed after use. Compromising one key reveals nothing about past or future requests
The effect: GUT gets modern LLM capabilities inside a compliance posture that holds up — the AI provider transmits and stores only ciphertext, and the sensitive payload exists in plaintext solely on GUT’s own systems.
Compliance Built In, Not Bolted On
Because the platform was designed for HR from day one, data protection is a property of the system, not a manual process:
- Consent capture — applicants give active consent on the public application form; the timestamp and exact wording are stored on the candidate record as proof (Art. 7 GDPR)
- Retention enforcement — applicant data is physically deleted — across all derived tables and stored files, not just flagged — after the retention period (Art. 5(1)(e) and Art. 17 GDPR)
- Data subject rights — one-click export of everything stored about a person (Art. 15/20) and targeted, irreversible erasure (Art. 17), both audited
- Immutable audit log — every automated action is recorded append-only: who or what did it, when, and why
- AI transparency — applicants are told that an AI system pre-sorts applications and a human makes the final decision (Art. 26(11) EU AI Act) — no solely automated decisions under Art. 22 GDPR
The Results
With NOMYO AI as the backbone, GUT has been able to:
- Automate the busywork — mailbox triage, CV extraction, and profile writing run automatically; staff spend their time reviewing and placing, not copy-pasting
- Keep humans in the loop — the AI proposes scored, explained matches; the dispatcher decides. Every suggestion carries its reasons and its gaps
- Protect candidate data end to end — E2EE inference on the way in, anonymization with automated PII verification on the way out
- Make compliance structural — consent, retention, subject rights, and audit trails are enforced by the platform itself, ready for review by a data protection officer
HR Is Where AI Has to Earn Trust
Staffing lives on personal data — there is no way to run the business without it. That makes HR a proving ground for a simple thesis: the value of AI doesn’t have to come at the price of exposing the people it works for.
GUT’s setup shows the pattern. A workflow platform that keeps the human in the decision, an inference service that never sees the data in plaintext, and compliance that is built into the system rather than audited after the fact. NOMYO AI provides the encryption and the automation that turn that pattern into daily operations.
GUT Personalmanagement GmbH is headquartered in Munich, Germany. Learn more at gut-personalmanagement.de.