Security at HiredIn

Our security program is risk-based and continues to develop as the Platform, technology, legal requirements, and threat environment evolve. This page provides a practical overview for customers, prospective customers, candidates, and other direct users.

Cloud Hosting and Data Protection

HiredIn's production environment is hosted on Amazon Web Services. AWS is responsible for the physical and environmental security of its data centres, while HiredIn is responsible for configuring and operating its cloud resources, applications, identities, and customer-facing controls.

• Encryption in transit: information transmitted over public networks is protected using HTTPS with TLS 1.2 or higher.
• Encryption at rest: AWS-hosted production storage uses AWS-managed encryption at rest using AES-256 or an equivalent industry-standard mechanism where supported.
• Tenant separation: application and access controls are designed to prevent unauthorized association of customer data across customer environments.

Account Access and Permissions

Access to production systems and customer information is based on legitimate business need. HiredIn uses unique accounts, role-based permissions, least-privilege practices, and additional safeguards for privileged access.

• Multi-factor authentication is required for privileged access where supported and may be available or required for Platform users.
• Access permissions are reviewed periodically and removed when they are no longer required.
• Customer administrators control their authorized users, roles, permissions, and account deprovisioning within the Platform.

Application and Operational Security

HiredIn follows documented development and change-management practices intended to reduce security and reliability risks when code, configurations, infrastructure, or Platform features are changed.

• Software and infrastructure changes use version control, review, testing, risk-appropriate approvals, and controlled deployment practices.
• Vulnerability, patch, configuration, dependency, code, and change-management activities are conducted according to the Services and the risks involved.
• Relevant authentication, administrative, infrastructure, security, and application events are logged. Access to logs is restricted, and significant events are reviewed and escalated through applicable procedures.
• Reasonable rate limits, usage restrictions, or temporary account measures may be used to protect the Platform from abuse, suspicious activity, and service disruption.

Backups and Service Resilience

Production information is protected through documented backup and recovery procedures. Backup access is restricted, and recovery procedures are reviewed or tested periodically in accordance with HiredIn's policies and the capabilities of the applicable AWS services.

Specific uptime, recovery-time, recovery-point, support, or service-credit commitments apply only when they are included in an applicable Order Form, service-level agreement, security addendum, or other written agreement.

Incident Response

HiredIn maintains incident-response procedures designed to identify, contain, investigate, mitigate, remediate, and document material security and privacy events.

• If HiredIn becomes aware of a Personal Data Breach affecting customer personal data, the affected customer will be notified without undue delay through its designated administrative or security contact.
• Initial notification will not be delayed solely because an investigation is incomplete. Additional information may be provided in phases as it becomes available.

Privacy and Responsible Data Use

For customer-controlled recruitment information, the customer generally determines why and how the information is used, and HiredIn processes it to provide the Services under the applicable agreement and Data Processing Addendum. HiredIn acts independently for certain account, billing, security, website, usage, and direct-to-user activities where it determines the purposes and means of processing.

• Data collection and access are limited to information reasonably necessary to provide, secure, support, and administer the Services.
• Retention and deletion are managed according to the applicable agreement, Privacy Policy, account settings, legal requirements, security needs, and technical limitations.
• HiredIn supports applicable access, correction, portability, suppression, and deletion requests according to its role and applicable law.

AI-Assisted Features

HiredIn may use AI-assisted features for resume parsing, matching, ranking, screening insights, summaries, communications, interviews, analytics, market intelligence, and candidate career-preparation tools. AI outputs are advisory and should be reviewed by a qualified person before being relied upon.

• HiredIn does not use customer personal data to train or fine-tune a publicly available, general-purpose, or cross-customer model without the customer's express written authorization and an appropriate lawful basis.
• Third-party AI providers processing customer data are subject to contractual restrictions appropriate to their role, including restrictions on using customer inputs and outputs to train general-purpose models unless expressly authorized.
• Aggregated, anonymized, de-identified, or synthetic information that does not reasonably identify a customer or individual may be used for security, analytics, benchmarking, and Platform improvement, subject to applicable law and contractual commitments.
• HiredIn does not make final hiring, rejection, advancement, compensation, or other employment decisions for customers. Customers remain responsible for lawful criteria, notices, assessments, human review, and final decisions.

Service Providers and Connected Services

HiredIn uses service providers to support cloud infrastructure, AI processing, communications, video, scheduling, payments, support, and related operations. Providers acting on HiredIn's behalf are subject to written confidentiality, security, data-protection, and incident-notification obligations appropriate to their role.

Customer-enabled integrations are optional and may operate under their own terms and privacy practices. Customers are responsible for selecting connected services, reviewing requested permissions, configuring them appropriately, and disconnecting services that are no longer required.

Security Is a Shared Responsibility

HiredIn protects the Platform and its processing environment. Customers, candidates, and other users remain responsible for the devices, accounts, permissions, information, and connected services under their control.

• Use strong account-security practices and enable multi-factor authentication where available.
• Protect login credentials and promptly report suspected unauthorized access or account compromise.
• Assign appropriate roles, review user permissions, and remove access that is no longer required.
• Protect information exported, copied, emailed, integrated, or otherwise moved outside the Platform.
• Provide required notices, obtain required consents, and use recording and AI features lawfully and responsibly.

Security Assurance and Customer Reviews

HiredIn's security and compliance program is designed with reference to recognized industry practices, including the AICPA Trust Services Criteria. HiredIn is progressing through compliance and independent assurance activities as the Platform and organization mature.

Available security documentation, testing summaries, policies, or questionnaire responses may be provided to customers upon reasonable request and subject to confidentiality. HiredIn will identify a certification, audit report, or independent attestation only after it has been completed and expressly confirmed through the HiredIn Trust Center or in writing.

Contact HiredIn

Website: HiredIn website
Privacy and security inquiries: privacy@hiredin.ai
Platform support: support@hiredin.ai

About this overview: This page is an informational summary and does not create a separate warranty, service level, certification, or contractual obligation. If it conflicts with an applicable agreement, the applicable agreement controls.