security
Security you can check
Built for DPDP 2023 and GDPR from the first line of code.
How we protect your data
Tenant isolation
Every record lives under its company’s path, every server function checks the caller’s company first, and 500+ automated tests — including randomised ones — try to read across companies and fail.
Data in India
Database, files and processing run in Google Cloud Mumbai (asia-south1).
Sign-in
Staff sign in with Microsoft 365 (or a one-time email link). Candidates never create accounts; their links are single-purpose, 256-bit and stored only as hashes.
Encryption
TLS everywhere and HSTS on every page. Data encrypted at rest; your AI provider keys and calendar tokens are additionally encrypted with a dedicated key (Cloud KMS).
Least privilege
Interviewers see a redacted view; salary, notice period and contact details stay with HR. Verified by a browser test that inspects every response an interviewer receives.
Safe files
Resumes must be real PDFs under 5 MB, are scanned for malware and stripped of scripts before anyone opens them.
Tamper-evident audit
Every change is appended to a hash chain; editing or silently deleting a record breaks it.
Privacy rights
Consent recorded with each application. Export or delete a candidate’s data — files, search index and all copies — within 30 days. Automatic deletion after your retention period.
AI
Contact details, address, date of birth and salary are removed before any AI call. AI never makes a decision.
Headers and dependencies
A strict Content-Security-Policy, framing blocked, dependency audit at zero known vulnerabilities, and the full code history scanned for secrets.
Documents
Start with the free plan
One job, three teammates, 200 applicants a month. No card, no time limit.