Trust & Security | CandidHQ

Data residency

Primary database and file storage: Supabase, eu-west-2 (London).
Error reporting: Sentry, EU (Frankfurt).
Application compute: Vercel on the Pro plan, function region pinned to London (lhr1). Edge caches are global.
The AI features (the candidate prep assistant and recruiter content drafting) call Anthropic in the United States. That single hop is covered by Standard Contractual Clauses; nothing else leaves the UK or EU on the application path.
Integrations you connect (your ATS, your Slack workspace) exchange data with your own accounts at those providers. See Sub-processors for what flows where.

Encryption

All traffic uses TLS 1.2+ with HSTS enabled and a two-year max-age.
Data at rest in Supabase Postgres and Storage is encrypted with AES-256.
ATS credentials (API keys and OAuth tokens) are additionally encrypted with AES-256-GCM under a key held outside the database, so a copy of the database alone cannot be used to reach your ATS.
Secrets are stored in Vercel's encrypted environment variable system, never in source.

Access control

Every tenant-scoped table has row-level security enabled at the database layer, so a signed-in user can only read or write their own company's rows. Team roles are enforced there too, as a second check behind the application.
Two-step sign-in with an authenticator app. Each person can turn it on, and owners and admins can require it for the whole workspace. It is enforced in the database as well as the application, so a password alone reaches no data.
Four team roles (owner, admin, recruiter, viewer). Viewers are read-only, and billing, team management and data exports are limited to owners and admins.
Service-role database access is restricted to server-side code and is never exposed to the browser. Server code that uses it checks company ownership explicitly, and automated tests guard those checks.
Candidate portals are accessed by a per-portal private link. Recruiters can archive or expire a portal at any time, which closes the link.

Auditing

State-changing admin actions write an entry to an audit log recording the actor, target, IP, user agent, and timestamp.
The audit log is written only by our servers. Customers can read their own company's log but cannot edit or delete entries.
Audit failures are reported to Sentry so they cannot be silently dropped.
Inbound webhooks from Stripe, Slack, and connected ATSs are signature- or secret-verified before they are processed. Where an ATS does not sign its webhooks, the endpoint carries a per-connection secret that is checked on every request.

Application hardening

A Content Security Policy restricts script, style, frame, and connect origins. frame-ancestors 'none' plus X-Frame-Options: DENY prevent clickjacking.
Permissions-Policy denies camera, microphone, geolocation, payment, USB, and FLoC.
Rate limits on sign-in, sign-up, password reset, and every candidate-facing endpoint (per-IP, per-portal, per-day, per-lifetime).
All user-supplied HTML is sanitised through an allowlist before render or storage.
All form inputs are validated through Zod schemas at the server-action boundary.
Scheduled jobs refuse to run without their secret, rather than running open.

AI assistant safety

The candidate prep assistant is off by default. A workspace owner or admin switches it on, and while it is off no candidate data is sent to Anthropic.
When it is on, each question a candidate asks is sent to Anthropic in the United States with the candidate's name and current interview stage, and the portal content the answer is drawn from. The transfer is covered by the EU Standard Contractual Clauses and the UK Addendum, Anthropic deletes API inputs and outputs within 30 days, and it does not train its models on them.
The candidate prep assistant is grounded only in content the recruiter put on the portal.
It is instructed to refuse off-topic requests, salary negotiation, and questions about other candidates.
Per-portal and per-IP rate limits cap how often it can be invoked.
A combined monthly AI spend cap per customer prevents runaway cost from abuse.
AI drafting for recruiters runs under a shared confidentiality instruction that keeps sensitive internal notes out of candidate-facing copy.
Anthropic does not train on API inputs; the company-supplied terms cover that explicitly.

Data minimisation

We deliberately do not store CVs, phone numbers, postal addresses, dates of birth, demographic data, or any special-category data (health, race, religion, biometric). The salary information we hold is limited to the role's range as set by the recruiter, and an expectation the candidate chooses to share on their portal. CandidHQ's candidate data footprint is materially smaller than a typical Applicant Tracking System. See the Privacy Policy for the exact list.

Retention

Candidate portal data is automatically purged 365 days after portal expiry by default. Recruiter customers can configure a shorter window inside the admin.
Account data for cancelled recruiter accounts is deleted within 90 days.
Audit logs are kept for 24 months; billing records for 7 years to meet UK tax law.

Right to erasure (DSAR)

Recruiters have a one-click export and delete inside the admin for any candidate record, and can export their whole workspace. Candidates can request access or erasure directly via the recruiter, or by writing to privacy@candidhq.tech; we respond within 30 days.

Incident response

Runtime errors are captured by Sentry with PII scrubbing; on-call review is part of the working week.
In the event of a personal-data breach, we will notify affected recruiter controllers within 72 hours of becoming aware, with the facts, scope, mitigations, and contact information required for them to meet Art. 33 UK GDPR.
Stripe and Supabase incidents are monitored via their respective status pages.

Backups & recovery

The database is backed up daily by Supabase, with backups retained for 7 days on our current plan.
Restores are tested. On 25 October 2026 the latest backup was restored to a separate project in under 4 minutes and checked table by table against the live database.
File storage is replicated by Supabase's underlying provider.

Certifications & assurance

CandidHQ is registered with the UK Information Commissioner's Office under registration number C1941533 (verifiable on the ICO public register).

CandidHQ Ltd is Cyber Essentials certified for the whole organisation, certified on 14 October 2026 and due for renewal by 14 October 2027. Certificate number 45f79fa1-a62a-4aa2-b98d-242eb43ac76e can be checked on the BlockMark registry. Cyber Essentials is the UK government-backed scheme, run by the NCSC with IASME, covering firewalls, secure configuration, user access, malware protection and patching.

We do not yet hold a SOC 2 report; it is on our roadmap, and current status is available on request via privacy@candidhq.tech. Sub-processor certifications (Supabase SOC 2 Type II, Vercel SOC 2 Type II, Stripe PCI DSS Level 1) are inherited at the platform layer.

What we have not yet done

Transparency is part of the security posture. As of 14 October 2026: we have not yet completed an external penetration test, do not yet hold an independent SOC 2 report, and do not yet offer SSO/SAML or customer-managed encryption keys. These are on the roadmap and we will update this page as each lands. Customers with specific requirements can write to privacy@candidhq.tech.

Responsible disclosure

If you believe you have found a security vulnerability, please report it to security@candidhq.tech. Our contact details are also published at /.well-known/security.txt. We acknowledge reports within 2 business days and aim to triage within 5. We do not run a paid bug bounty today, but we credit researchers (with consent) on a hall-of-fame page once we publish one.