Security & data protection
Written for whoever reviews suppliers at your firm. Plain statements of what the system does, with no marketing language.
Separation between clients
- A separate database for each client
- Your CV records are held in their own database, not in a shared table alongside another firm's. Databases are created per client at setup.
- A separate mailbox for each client
- Each client forwards to their own address. Mail is not pooled.
- Your own Invenias credentials, encrypted at rest
- Stored with AES-256-GCM and decrypted only in memory at the point of use. CVs are filed into your Invenias under a dedicated API user, not a shared login.
- No client identifier in any portal address
- Which client you are is taken from your signed-in session, never from the URL, so one client cannot address another's data by editing a link.
Access to the portal
- Password authentication with a 60-minute inactivity timeout
- Sessions end after an hour of inactivity and must be signed in again.
- Lock-out after five failed attempts from an address
- Repeated failures from one address are locked out for fifteen minutes.
- Responses that do not reveal who is a customer
- A wrong email address and a wrong password produce the same response, so the sign-in form cannot be used to discover whether a firm is a client.
- CSRF protection on every action that changes something
- Verified server-side, and a mismatch is recorded.
- A full audit trail
- Sign-in, export, domain change and billing action are all recorded with the time and originating address.
Incoming mail
- Every sender is checked, and the result is visible to you
- SPF, mail-server validity and disposable-address detection are recorded for every message and shown per email in your security log.
- You control which domains may send
- You register the email domains your firm sends from. This is both the routing key and the control over who can put CVs into your database.
- Nothing is deleted early, or by accident
- Every message is archived after processing and only ever copied from, so a CV can be reprocessed at any point while it is held. Messages are deleted only when they reach the retention period, or when you ask us to — see Retention and deletion below.
- Accepted attachments
- PDF, DOCX, DOC, HTM and HTML. Other formats, including executables and archives,
are not processed.
The demo is narrower on purpose and takes PDF or DOCX only. It accepts a file from anyone on the internet, so every upload is checked against its own contents rather than its name — and the legacy DOC format cannot be inspected that way.
Retention and deletion
Storage limitation is Article 5(1)(e) UK GDPR, so an archive that is never deleted is a finding waiting to happen. These are the commitments that govern it.
- How long the archive is kept
- Three months from the date a message arrives, after which it is deleted automatically. Deletion runs daily and is recorded.
- What happens when the contract ends
- Your archive is deleted 30 days after the contract ends. We provide a full export of your import history on request before then, so you keep your own record of what was filed and when.
- Deletion and backups
- Deletion removes your data from the live system immediately. Encrypted backups are kept on a rolling fourteen-day cycle, so a deleted archive persists in those backups until the last generation containing it expires — within fourteen days. Backups are restored only to recover from failure, never to reinstate deleted data.
- How an erasure request is handled
- You are the controller for candidate data. We act on your instruction, and delete the archived original when you tell us to. If a candidate contacts us directly we pass the request to you within one working day.
- Breach notification
- If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 24 hours of becoming aware, with what we know at that point and what we are doing about it.
Logging
- Email addresses are masked in operational logs
- Our own diagnostic logging records that a message was handled, not who sent it. Full addresses appear only in your portal, visible to you.
Hosting and subprocessors
The service runs on AWS in the EU (Ireland). These are the third parties involved in delivering it:
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Hosting and storage | EU (Ireland) |
| Invenias (Bullhorn) | The destination for your CVs — your own existing account | Per your Invenias agreement |
| Xero | Invoicing | EU / UK |
| Stripe | Card payments | EU / UK |
Changes to this list. We will tell you before a new subprocessor begins handling your data, so you have the opportunity to object.
Candidate CV data is processed only to file it into your Invenias. It is not used for any other purpose and is not shared with anyone else.
Questions from a compliance review
If your reviewer needs something not covered here — a DPA, a completed security questionnaire, or detail on a specific control — write to [email protected] and we will answer it directly.