Security and privacy
Private by default. Deliberate when shared.
An agency wants to know whether another agency, or Recruited, can see or use its database. A candidate wants to know who can see their details and what they can stop. An employer wants to know who reads a Brief. This page answers all three with what is implemented.
The short version
- The workspace is a tenant boundary enforced on the server, in one place, and tested.
- There is no shared candidate database. LINK is an ordinary customer.
- Nothing identifying a candidate moves to another party without that candidate’s approval.
- AI reads only what the person asking could read by hand.
- Your data does not train models shared with other customers.
- An agency can export everything, any time, and leave.
The workspace boundary
What one agency can reach, and what it cannot.
The boundary is applied server-side on every request. Hiding something in the interface is a convenience, not a control.
-
Authentication
Passwords are hashed with scrypt. Sessions are signed and carry an audience claim, so a token issued for another product on the same infrastructure can never authenticate a request here. Two-factor authentication with a time-based code is included on every plan.
-
Membership and roles
Access is per workspace, per member, with a role. Invitations expire. A member removed from a workspace loses access immediately, and their history stays attached to the records they touched.
-
The database boundary
Row-level security is on with no anonymous policies, so the publishable key can read nothing, which is why the browser never holds a database key. Every request goes through the API with a signed session.
-
One place scoping is decided
The workspace filter and the “may this member see this candidate” check live in one module, and no endpoint hand-rolls its own. A member with no workspace fails closed, and there is a test that proves it.
-
Audit history
An append-only activity ledger records what happened, and it is the source every metric is computed from, so it cannot be quietly disabled without the reporting breaking. Authentication events are recorded separately.
-
Files
Documents live in a private bucket. Access is through short-lived signed URLs, uploads go straight to storage, and a document is reachable only through a record you can already see.
The publication boundary
The one deliberate route out of a workspace.
Exchange is a publication boundary rather than a shared store. This is what that means in practice.
Agency A workspace
- Candidate records
- Client relationships
- Communications
- Notes and documents
Stays inside
What crosses
- Masked signalShape of the role or the experience. No name, no CV, no employer identity.
- Accepted termsA verified participant accepts the collaboration, the confidentiality step and the timer.
- Candidate approvalThe candidate approves this disclosure, to this party, for this purpose.
- Secure Candidate RoomPurpose-limited, audited, and closable. Withdrawal is available throughout.
Agency B workspace
- Their candidates
- Their clients
- Their communications
- Their documents
Stays inside
There is no pooled database in the middle. Nothing is published that you did not publish, and nothing identifying a person crosses without that person’s agreement.
-
The Secure Candidate Room
Purpose-limited, audited, closable, and scoped to one introduction. Not a folder somebody keeps a copy of.
-
The Identity Conflict Service
Tells a receiving agency they may already hold this person. Cannot reveal which other agency does, cannot expose either record, and cannot be used to enumerate anybody’s database.
-
Nothing implicit
No standing licence, no default publication, and no collaboration that continues past its timer because nobody cancelled it.
AI
What AI is allowed to see, and what it is allowed to do.
-
Scoped retrieval
An AI feature can only read what the requesting member could read by hand. There is no privileged retrieval path, and no query that crosses a workspace.
-
Evidence, always
A summary cites the message each sentence came from. A search result names the field or document it matched on. Anything that cannot show its source is not shown as fact.
-
Human decisions
AI ranks, drafts and summarises. It does not publish, contact anyone, or decide who is hired.
-
No cross-customer training
Your data is not used to train models shared with other customers.
Your data, your rights
Retention, correction, deletion and export.
-
Retention
Records are kept while you need them and removed when you say so. Enterprise workspaces set custom retention policies.
-
Correction
Any record can be corrected, including on behalf of a candidate who asks. Corrections are recorded rather than silent.
-
Deletion
Deletion requests are honoured, and where something must be retained for a legal reason you are told what and why.
-
Export
The full workspace, in an open format, on any plan, at any time, including the day you leave.
Migration handling is covered on the switching page, including staging isolation and deletion evidence.
If you are not an agency
What this means for a candidate, and for an employer.
Most of this page is written for the agency whose database it is. These are the parts that apply to the other two people who read it.
If you are a candidate
The agency you are dealing with holds your information inside its own workspace. No other agency and no employer can browse it, and there is no shared database for anyone to search. Nothing that identifies you moves to another party until you approve that specific introduction, and you can withdraw. You can ask to see, correct or delete what is held.
If you are an employer
Your business is verified by ABN before a Brief is published. A Brief is read by verified agencies on Recruited; it is not a public listing and it is not sent to job boards. Candidate information reaches you only through an agency you appointed, with the candidate’s agreement, which is why you cannot browse anyone’s database.
Assurance
What a technical review covers.
Certifications
Recruited does not currently hold SOC 2 or ISO 27001 certification. The controls on this page describe what is implemented, and a technical review walks through them with the engineers who built them.
Hosting and subprocessors
Hosting region and the current subprocessor list are provided in writing during a technical review, so the statement stays accurate as vendors change.
Contact
Reporting something, and hearing back.
Security reports
security@recruited.com.au reaches the people who can act on it. Include what you found, how to reproduce it and how you would like to be credited. We do not pursue anyone who reports a genuine issue in good faith and does not access or alter another customer’s data.
Privacy requests
privacy@recruited.com.au for access, correction and deletion, whether you are a customer or a candidate whose information a customer holds. A candidate should usually start with the agency they dealt with, and we help either way.
Security issues must not go through the sales form. See also the privacy policy and terms.
Questions
Is Recruited certified to SOC 2 or ISO 27001?
Recruited does not currently hold SOC 2 or ISO 27001 certification. This page describes the controls that are implemented so you can assess them directly, and a technical review walks through them with the people who built them.
Where is our data stored?
In our managed database and object storage. The hosting region and the current subprocessor list are provided in writing during a technical review, so the statement stays accurate as vendors change.
Who at Recruited can see our workspace?
Access to customer data is limited to what is needed to operate and support the service, is authenticated, and is recorded. Support access to a workspace is an auditable event.
How do we report a security issue?
Email security@recruited.com.au. Security reports do not go through the sales form.
I am a candidate. What does this page mean for me?
That the agency you are dealing with holds your information inside its own workspace, that no other agency and no employer can browse it, and that nothing identifying you moves to another party without your approval for that specific introduction. You can ask to see, correct or delete what is held. The candidates page sets out how.
I am an employer. Who can see my Brief?
Verified agencies on Recruited. A Brief is not a public listing and is not sent to job boards. Candidate information reaches you only through an agency you appointed, with the candidate’s agreement.
Security
Bring your hardest questions.
A technical review is a conversation with the people who wrote the code, not a slide deck.
We reply within one Australian business day.