Recruiting software security you can explain to your finance team
Recruiting software security comes down to who can reach candidate data, how mailbox and calendar access is granted and revoked, and what happens to data over time. RecruitingBot encrypts connections and tokens, isolates workspaces, limits access by role and deletes data on schedule.
- GDPR built in
- Human approves every shortlist
- No hiring fees
| Client | Roles | Shortlists |
|---|---|---|
| Northwind Logistics | 6 | 3 |
| Bluepeak Health | 4 | 2 |
| Fintrack | 9 | 5 |
| Orbit Retail | 3 | 1 |
Fictional client names. Each client sees only its own roles.
What a buyer should actually worry about
If you run finance or operations, or you own an agency, the risks in a recruiting tool are concrete. The software holds personal data about people who never signed up for anything. It can send email in the name of your company. It may sit between your agency and several clients who must never see each other's candidates. And it bills a card every month. A useful security review asks how each of those four exposures is contained, not whether a vendor uses the right adjectives.
This page answers those questions directly. We do not claim certifications we do not hold, and you will not find a badge wall here. What you will find is a plain description of how access, encryption, isolation, sending and retention work, so you can compare it against your own policy and decide with your eyes open.
Mailbox and calendar access you can revoke
Outreach goes from your own Gmail or Outlook and Microsoft 365 mailbox, and interviews are booked into Google Calendar or a Microsoft 365 calendar. Both connections use OAuth, which means you sign in with the provider and approve a scoped grant. RecruitingBot never sees or stores your mailbox password. The access token the provider issues is stored encrypted at rest and used only to send outreach, read replies to it and manage interview events.
You can disconnect a mailbox or calendar from the settings page at any time, and you can also revoke the grant from the provider side through your usual admin console. Either action stops sending and syncing immediately. When a recruiter leaves, removing their seat and disconnecting their mailbox closes the door in two clicks, with no shared password to rotate afterward.
Encryption in transit and at rest
All traffic between your browser and RecruitingBot, and between our servers and the services we connect to, is encrypted in transit with TLS. Mailbox and calendar tokens are encrypted at rest with keys kept apart from the data itself, so a copy of the database alone does not hand anyone access to your email account. Candidate data is hosted with a hosting provider in the EU.
Backups are taken regularly so a failure does not cost you your pipeline, and they follow the same retention logic as live data, which means deleted candidates age out of backups rather than lingering indefinitely. We keep the number of places candidate data lives deliberately small, because every extra copy is one more thing to protect.
Seats, roles and need to know access
Every person who signs in has their own seat, and each seat carries a role. Owners manage billing, mailboxes, retention settings and the team. Recruiters run roles, edit rubrics and work the inbox. Hiring managers see the shortlist for the roles they are attached to and approve or reject candidates, without wandering through every other opening in the workspace. Role based permissions are part of Growth and Agency.
Inside our own team, access to customer data follows the same principle. Production access is limited to the few people who operate the service, it is granted for a reason rather than by default, and we do not browse candidate records out of curiosity. Support works from what you share with [email protected], and we only look at a workspace when it is needed to answer your request.
- Lawful basis
- Legitimate interest, assessment v2 attached
- Source
- Public professional profile
- Article 14 notice
- Included in first message
- Opt out
- One click, suppression list
- Retention
- Deletes in 30 days without reply
| Role | Can do | Cannot do |
|---|---|---|
| Owner | Manage billing, team, mailboxes, retention and all roles | Nothing is hidden from the owner within the workspace |
| Recruiter | Create roles, edit rubrics, run outreach, handle replies | Change billing or retention settings |
| Hiring manager | View assigned shortlists, approve or reject candidates | See unrelated roles or send outreach |
Isolation between workspaces and agency clients
Each customer workspace is logically separated from every other, and every query that reads candidate data is scoped to the workspace that owns it. For agencies there is a second wall inside the first: client workspaces. Candidates, roles, shortlists and branding for one client stay in that client's space, so a hiring manager at one company never stumbles across a shortlist built for another.
Growth includes three client workspaces and Agency includes as many as you need, with white label shortlists so your client sees your brand rather than ours. If you run a desk of recruiters across many accounts, the setup is covered in more depth on our page about AI recruiting software for agencies.
Single sign on and an audit log on Agency
Larger teams usually want two things from a security review: one place to switch people on and off, and a record of who did what. The Agency plan includes single sign on through SAML, so access follows your identity provider and a leaver loses access when their directory account is disabled. It also includes an audit log of significant actions such as role launches, rubric edits, mailbox connections, exports, deletions and shortlist decisions.
The audit log is most useful in the moments you hope never come: a client asks who approved a shortlist, a candidate disputes how their data was handled, or a finance lead wants to confirm that only authorized people exported anything. Agency also includes a DPA download and an annual invoice, which tend to be the documents procurement asks for next.
Sending caps that protect your domain reputation
Email reputation is a security asset that rarely appears on a checklist. If a tool blasts hundreds of messages from your domain in an hour, inbox providers start routing your normal business mail to spam, and that damage outlasts any recruiting campaign. RecruitingBot sends only within a daily cap you set per mailbox, only between 8:00 and 20:00 in each recipient's local time, and spaces follow up steps over days.
Every message also contains a one click opt out, and anyone who uses it lands on a suppression list that blocks future outreach from the whole workspace. Fewer unwanted messages means fewer spam complaints, which keeps your domain healthy. The privacy side of the same mechanism, including notices and lawful basis, is explained on our page about GDPR compliant candidate sourcing.
Payments, retention, deletion and incidents
Card payments are handled by our payment operator on its own hosted checkout. Card numbers go directly to the payment operator and are never seen or stored by us. Invoices and plan changes are managed in the billing portal, and you can cancel any time there to stop renewal.
Candidate data does not live forever. Sourced people who never respond are deleted automatically after 30 days by default, with a window you can set from 30 to 180 days, and any single candidate can be exported or deleted in one click. If we ever identify an incident affecting your data, we investigate, contain it and notify the workspace owner without undue delay with what we know, so you can meet your own obligations as controller. Questions about any of this go to [email protected].
- No card storage. Payment details are processed by the payment operator, never on our servers.
- Scheduled deletion. A daily retention job removes candidates whose retention date has passed.
- Clean exit. If you close your workspace, candidate data is deleted rather than archived for later use.
-
Day 1
First messageSent
Personal note on their payments work, role facts, salary range, opt out link
-
Day 4
Follow upSent
Short nudge with one new detail about the team
-
Day 9
Last noteScheduled
Polite close, door left open
Questions buyers ask
Anything else goes to [email protected] or the help panel inside your dashboard.
Do you hold third party security certifications?
We do not hold third party security certifications today, and we will not imply otherwise. This page describes the controls we actually run: TLS in transit, encrypted mailbox tokens, OAuth connections you can revoke, workspace isolation, role based access, SSO and an audit log on Agency, sending caps and automatic deletion. If your policy requires a specific certification, use that as a filter when you compare vendors.
Can RecruitingBot read all of my email?
The mailbox connection is used to send outreach and to read replies in those outreach threads so they can be classified. Your password is never shared with us, the access token is stored encrypted, and you can revoke the grant from our settings or from your email provider whenever you choose, which stops all access at once.
What happens to candidate data if we cancel?
Cancelling in the billing portal stops renewal, and your workspace stays usable until the end of the paid period so you can export what you need. Retention rules keep running throughout. When the workspace is closed, candidate data is deleted rather than kept for any other purpose.
How do you keep agency clients apart?
Each client gets its own client workspace inside your agency workspace, with separate roles, candidates, shortlists and branding. Hiring managers only see shortlists for roles they are attached to. Growth includes three client workspaces and Agency removes the limit and adds white label shortlists.
Which plan has single sign on?
Single sign on through SAML is part of the Agency plan, along with roles, an audit log, a DPA download and an annual invoice. Growth includes roles without SSO. You can compare allowances and features on the AI recruiter pricing page and upgrade at any time, with the price difference charged immediately.
Who do I contact with a security question?
Write to [email protected] with your question or the security questionnaire your procurement team uses. Include the plan you are evaluating and the parts that matter most to you, such as mailbox access, retention or data location, and we answer from what the product actually does today.
Keep reading
Give it a role and see the shortlist it builds
Type a job title on the homepage. The demo runs instantly without an account and shows an example pipeline, job post and shortlist for that role.