security
Security you can check
Built for DPDP 2023 and GDPR from the first line of code.
How we protect your data
Tenant isolation
Every record lives under its company’s path, every server function checks the caller’s company first, and 500+ automated tests — including randomised ones — try to read across companies and fail.
Data in India
Database, files and processing run in Google Cloud Mumbai (asia-south1).
Sign-in
Staff sign in with a one-time email link, and people who work for several companies switch between workspaces without mixing their data. Candidates never create accounts; their links are single-purpose, 256-bit and stored only as hashes.
Encryption
TLS everywhere and HSTS on every page. Data encrypted at rest; your AI provider keys and calendar tokens are additionally encrypted with a dedicated key (Cloud KMS).
Least privilege
Interviewers see a redacted view; salary, notice period and contact details stay with HR. Verified by a browser test that inspects every response an interviewer receives.
Safe files
Resumes must be real PDFs under 5 MB, are checked for known malicious content and stripped of scripts before anyone opens them.
Tamper-evident audit
Every change is appended to a hash chain; editing or silently deleting a record breaks it. A job verifies the chains every night and alerts us to a break.
Backups
Daily backups kept 14 days, weekly backups kept 14 weeks, and point-in-time recovery for the last 7 days, with a documented restore procedure.
Monitoring
Uptime checks and alerts on server errors, failed scheduled jobs and email that cannot be delivered.
Bots and abuse
Public forms use Cloudflare Turnstile and a verified email code. Firebase App Check is being rolled out and runs in monitoring mode for now.
Privacy rights
Consent recorded with each application. Export or delete a candidate’s data — files, search index and all copies — within 30 days. Automatic deletion after your retention period.
AI
Contact details, address, date of birth and salary are removed before any AI call. AI never makes a decision.
Headers and dependencies
A strict Content-Security-Policy, framing blocked, dependency audit at zero known vulnerabilities, and the full code history scanned for secrets.
Documents
Start with the free plan
One job, three teammates, 200 applicants a month. No card, no time limit.