Security & Data Protection

We use Stytch as our identity provider for secure authentication, supporting both Consumer and B2B Single Sign-On (SSO).

• Multi-factor authentication (MFA) available for all accounts
• Sessions validated using cryptographically signed tokens
• Role-based access control with fine-grained permissions at the job level
• Secure session management with strict cookie policies and automatic expiry

Our platform uses AI to power features such as CV parsing, candidate matching, and interview preparation. We take the security and privacy of this layer seriously.

• PII redaction — for key pipelines such as CV parsing, personal identifiers (name, email, phone) are redacted with placeholders before data is sent to our AI provider
• Prompt injection protection — all user-provided text is scanned for injection patterns and sanitized before processing. Suspicious inputs are blocked automatically
• System prompt hardening — every AI prompt includes explicit security rules instructing the model to ignore any instructions found within user data
• Structured output validation — AI responses are validated against strict schemas. Unexpected or malformed outputs are rejected
• Data isolation — user data is never used to train AI models. We use the OpenAI API with data processing agreements that prohibit training on customer data

Privacy is built into our product design — not bolted on after the fact.

• Candidate identities are anonymized until an interview is confirmed, reducing unconscious bias
• Company-facing views use anonymous identifiers instead of real names
• Sensitive fields such as personal contact details are blurred by default
• Data minimization principles — we collect only what is necessary to deliver our services
• Access to personal data is logged with sensitivity classification (high, medium, low) in line with GDPR Article 30
• Full audit trail records who accessed what data, when, and from which context

As an EU-based platform, we are fully committed to the General Data Protection Regulation (GDPR). Our data processing is designed with European data protection standards at its core.

• Candidate data retained for up to 12 months, with re-consent required for continued processing
• Right to erasure requests honored within a 30-day grace period
• Granular email opt-out preferences — users control each communication type individually
• All automated emails include unsubscribe links
• Cookie consent managed transparently with clear user controls

For full details, see our Privacy Policy and Cookie Policy.

Our application is protected by multiple layers of defense against common and emerging threats.

• Rate limiting on sensitive endpoints to prevent abuse and brute-force attacks
• Protection against cross-site scripting (XSS), cross-site request forgery (CSRF), and SQL injection
• Security headers prevent clickjacking, MIME sniffing, and other browser-based attacks
• Content Security Policy restricts which resources the browser is allowed to load
• All API inputs validated against strict schemas before processing
• File uploads undergo content-type verification — actual file content is inspected, not just the extension
• Upload size limits enforced per file type
• Error responses are sanitized to prevent accidental data leakage

• All data in transit encrypted using TLS
• Sensitive data at rest encrypted using AES-256-GCM
• Database connections secured with SSL
• Data hosted within the European Union
• Strict environment isolation between production, staging, and development
• Infrastructure designed for high availability with automated health monitoring and alerting

• All payment processing handled by Stripe, a PCI DSS Level 1 certified provider
• No sensitive payment information (card numbers, bank details) is ever stored on our servers
• Stripe webhook communications verified using signature validation

We carefully select our sub-processors and hold them to the same standards we apply to ourselves. Data shared with third parties is limited to what is strictly necessary for the service they provide.

Where sub-processors are located outside the EU, data transfers are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards.

• Employee access follows the principle of least privilege — access is granted based on role and need
• Access to production systems and customer data is restricted to a small group of authorized personnel
• Security awareness is part of onboarding and ongoing team practices
• All code changes require peer review before deployment

• Centralized security monitoring tracks unauthorized access attempts and anomalous activity
• Real-time error tracking and alerting across the full application stack
• Distributed tracing, metrics, and structured logging for full observability
• Automated security testing covers OWASP Top 10 vulnerabilities including XSS, SQL injection, command injection, and path traversal
• All API endpoints documented and enforced through OpenAPI specification — undocumented endpoints are blocked
• Automated dependency scanning for known vulnerabilities