Security and privacy, stated only where we can prove it
Every claim below traces to the platform itself, an internal certification, or a published policy. Where something is not in place yet, it says so.
Last reviewed 4 August 2026No certifications claimedPrivacy Notice
This page is maintained by TaaSFlow to answer common security and privacy questions about the platform. It is our own account of how the system works — not an independent audit or a third-party verification.
Security overview
Documented
TaaSFlow is a single multi-tenant application. Every customer works inside their own organisation, and the database itself — not the interface — decides what each person can read.
Access decisions are enforced in the database with Postgres row-level security, so a request that skips the interface still returns nothing it should not.
Verified in the platform · RLS policies on every tenant-scoped table
The application runs on managed infrastructure: a managed Postgres database with authentication and file storage, and an edge hosting network with CDN and WAF in front of it.
Published policy · Privacy Notice §7
Candidate files are held in a private storage bucket. There is no anonymous read path; downloads are issued as time-limited signed URLs from a permission-checked server function.
Verified in the platform · CV download server function + private bucket policies
Sensitive tables — audit events, scoring runs, extracted evidence, processing jobs, contact submissions — are readable by platform staff only.
Internal certification · Tenant isolation certification, 23 July 2026
Data protection
Documented
What we hold, why we hold it, and the safeguards described in the published Privacy Notice.
Candidate data covers identification and contact details, professional history, CVs, screening answers, interview notes and recruitment communications.
Published policy · Privacy Notice §2
Special-category data is not intentionally collected. Where it is legally required or volunteered, it is handled with additional safeguards.
Published policy · Privacy Notice §2
AI is used for CV parsing and role-fit scoring, and no final hiring decision is made solely by automated processing — every score is reviewable by a human, and candidates can request an explanation.
Published policy · Privacy Notice §10
Candidates with an account can export their personal data and request deletion from their profile settings; anyone can request the same by email.
Your organisation's data is separated from every other organisation's data at the database layer.
Every tenant-scoped table carries a policy that compares the signed-in user against the organisation that owns the row. If there is no membership, the row is simply not returned — not hidden in the interface, but absent from the result.
Verified in the platform · is_org_member / is_org_viewer / is_org_editor / is_org_admin
Isolation was probed across two live organisations with real positions, candidates, messages, interviews, files and audit rows. Edited URLs, copied record IDs, filter manipulation, global search, realtime subscriptions and direct file access all returned nothing cross-tenant.
Internal certification · Tenant isolation certification, 23 July 2026
Candidates only become visible to a client organisation after an explicit approval for that organisation and role; releasing contact details is a separate permission again.
Verified in the platform · client_visibility gate on candidate matches
Realtime updates inherit the same policies, so a live subscription cannot deliver another organisation's changes.
Roles are stored separately from user profiles and checked server-side on every request.
Client roles are admin, editor and viewer. Admins manage the team, editors move candidates and roles forward, viewers can read what has been shared with them.
Internal certification · Role and permission matrix
Platform roles (platform admin, operations) are separate from customer roles and are never granted by a customer-side action.
Verified in the platform · is_platform_staff helper + staff-only policies
Role checks run in SECURITY DEFINER functions with a fixed search path, which prevents a caller from redirecting the check to their own objects.
Verified in the platform · search_path pinned to public, extensions
Support access by platform staff runs as a bounded, expiring session; every action is written to a support-action log and to the audit trail with the real actor retained.
Sign-in is handled by the managed authentication service, not by hand-rolled code.
Email and password sign-in, with password reset by emailed link. Failed sign-in returns a single generic message so it cannot be used to confirm whether an address exists.
Verified in the platform · Sign-in route
Google sign-in is available on the client start flow.
Verified in the platform · Intake OAuth flow
Anonymous sign-up is disabled; an account is always tied to a verified identity and an organisation membership.
Verified in the platform · Auth configuration
Server-side requests re-validate the caller's session token on every protected call rather than trusting anything sent from the browser.
Verified in the platform · Authenticated server-function middleware
Membership can be deactivated by an organisation admin, and the change is recorded in the audit trail.
Internal certification · Multi-org and revocation certification
Encryption
Documented
Encryption is provided by the underlying infrastructure and described in the Privacy Notice. We restate it here rather than making separate claims of our own.
The published Privacy Notice records encryption in transit (TLS 1.3) and encryption at rest (AES-256) as technical measures applied by our infrastructure providers.
Published policy · Privacy Notice §7
CV files sit in private object storage and are only ever reachable through short-lived signed URLs generated after a permission check — verified in the codebase.
Verified in the platform · Private bucket + signed-URL download path
Provider-level cryptographic attestations are held by our infrastructure providers. We do not operate our own key management service and do not claim customer-managed keys.
Data retention
Documented
Retention periods are published, not negotiated case by case.
Candidate profiles: two years of inactivity, then deleted or anonymised unless consent is renewed.
Published policy · Privacy Notice §8
CVs and related artefacts: purged 90 days after a recruitment process concludes or after last use.
Published policy · Privacy Notice §8
Job submissions: anonymised for statistical purposes two years after a position is filled or closed.
Published policy · Privacy Notice §8
Audit and security logs: retained 12 months.
Published policy · Privacy Notice §8
Cross-position matching runs on consent for up to 12 months, and that consent can be withdrawn at any time.
Published policy · Privacy Notice §8
Audit coverage
Documented
Anything that changes a hiring record leaves a record of its own. Nobody can quietly rewrite history.
Database triggers write an audit event on insert, update and delete for memberships, organisations, positions, candidate matches, scoring runs, scoring decisions, client decisions, interviews, files and screening questions.
Domain actions that are not a plain row change — invitations, support sessions, publication decisions, membership deactivation, reconciliation runs — are written explicitly by the server.
Scoring runs are append-only: once written, a run and the evidence it used cannot be edited, only superseded by a new run.
Verified in the platform · Immutability triggers on score runs
Subprocessors
Documented
The register in the Privacy Notice reflects the infrastructure and vendors actually in use, with purpose, jurisdiction and transfer safeguard for each.
Currently disclosed: managed database, authentication, storage and realtime; edge hosting, CDN, WAF and DNS; payments and tax; analytics, tag management and the AI models used for CV parsing and scoring; transactional email; sourcing and contact enrichment; consent-gated business-visitor identification; meeting scheduling; CRM; and productivity, mail and meetings.
Published policy · Privacy Notice §6
Material changes to the register are published before a new subprocessor begins processing candidate data.
Published policy · Privacy Notice §6
The register and the international-transfer wording are pending review by our legal counsel. Corrections are welcome at privacy@taasflow.com.
Where processing takes place today, stated plainly.
Processing may take place in the European Union and the United States. Our managed database and storage run in those regions, and hosting, CDN and WAF run on a global edge network.
Published policy · Privacy Notice §7
International transfers rely on Standard Contractual Clauses, and on the EU-U.S. Data Privacy Framework with the UK Extension where a provider is certified under it. A Transfer Impact Assessment is maintained internally.
Published policy · Privacy Notice §7
We do not currently offer selectable or single-region residency, and we make no in-region-only guarantee. If residency is a requirement for your procurement, raise it with us before signing so we can answer against the real configuration.
Incident response
Documentation in progress
Operational runbooks exist and are used. The externally-facing incident policy is being written down.
Fourteen operational runbooks cover the failure modes this system actually has — failed intake, CV parse failure, scoring failure, missing evidence, publication blockers, duplicate candidates, provider outage, email failure, realtime failure, access issues and migration problems.
Internal certification · docs/runbooks 01–14
Any incorrect candidate visibility is treated as a security incident until proven otherwise: access is reconstructed from the audit trail, and affected users and trace IDs are recorded.
Documentation in progress: a published incident-response policy with customer notification timelines and severity definitions. We are not stating a notification SLA until that document is signed off.
Business continuity
Documentation in progress
What we can verify today, and what is still being documented.
Database schema changes are applied as an ordered, reviewable migration history, which doubles as the record of what changed and when.
Verified in the platform · Migration history
Provider degradation has a defined operational response, including tenant notification.
Documentation in progress: backup and restore procedures, tested recovery objectives, and a disaster-recovery plan. We make no uptime guarantee, and we will not publish recovery targets before they have been tested.
What we do not claim
Documented
The fastest way to trust a security page is to see what it refuses to say. None of the following is true of TaaSFlow today, so none of it appears above.
No SOC 2, ISO 27001, HIPAA or PCI certification, and no audit report.
Internal certification · No certification held
No completed third-party penetration test to publish.
Internal certification · Not yet performed
No contractual uptime guarantee or published availability figure.
Internal certification · No SLA published
No claim of full GDPR, CCPA or PDPL 'compliance' as a status. The Privacy Notice describes how we process data under those laws; it does not certify us.
Published policy · Privacy Notice §5
Privacy and legal documents
Documented
The underlying documents, with the date each was last updated.
Global Recruitment Privacy Notice — last updated 12 May 2026. Covers collection, legal bases, subprocessors, transfers, retention, candidate rights and AI-assisted scoring.
Published policy · /privacy
Terms of Service — last updated 5 March 2026. Covers the subscription model, client obligations, candidate-data handling, liability and termination.
Published policy · /terms
Commercial trust pack — how pricing works, what you keep, and how scoring works.
Published policy · /trust
A Data Processing Agreement and a security questionnaire response pack are in progress. Ask us and we will send the current draft rather than a marketing summary.
Report a suspected vulnerability here. Please include enough detail to reproduce it, and give us a reasonable window before disclosing publicly. We do not run a paid bounty programme.
