This page is our own account of how the system works — not an independent audit or a third-party verification.
We do not claim SOC 2, ISO 27001, HIPAA, or full GDPR, CCPA or PDPL compliance. See the security page for what we do and do not hold. TaaSFlow holds no HIPAA certification, and no SOC 2 or ISO 27001 certification. See how AI is used in hiring.
Security overview
Documented
TaaSFlow is a single multi-tenant application. Every customer works inside their own organisation, and the database itself — not the interface — decides what each person can read.
Access decisions are enforced in the database with Postgres row-level security, so a request that skips the interface still returns nothing it should not.
Verified in the platform · RLS policies on every tenant-scoped table
The application runs on managed infrastructure: a managed Postgres database with authentication and file storage, and an edge hosting network with CDN and WAF in front of it.
Published policy · Privacy Notice §7
Candidate files are held in a private storage bucket. There is no anonymous read path; downloads are issued as time-limited signed URLs from a permission-checked server function.
Verified in the platform · CV download server function + private bucket policies
Sensitive tables — audit events, scoring runs, extracted evidence, processing jobs, contact submissions — are readable by platform staff only.
Internal review · Internal tenant isolation review, 23 July 2026
Data protection
Documented
What we hold, why we hold it, and the safeguards described in the published Privacy Notice.
Candidate data covers identification and contact details, professional history, CVs, screening answers, interview notes and recruitment communications.
Published policy · Privacy Notice §2
Special-category data is not intentionally collected. Where it is legally required or volunteered, it is handled with additional safeguards.
Published policy · Privacy Notice §2
AI is used for CV parsing and role-fit scoring, and no final hiring decision is made solely by automated processing — every score is reviewable by a human, and candidates can request an explanation.
Published policy · Privacy Notice §10
Candidates with an account can export their personal data and request deletion from their profile settings; anyone can request the same by email.
Your organisation's data is separated from every other organisation's data at the database layer.
Every tenant-scoped table carries a policy that compares the signed-in user against the organisation that owns the row. If there is no membership, the row is simply not returned — not hidden in the interface, but absent from the result.
Verified in the platform · is_org_member / is_org_viewer / is_org_editor / is_org_admin
Isolation was probed across two live organisations with real positions, candidates, messages, interviews, files and audit rows. Edited URLs, copied record IDs, filter manipulation, global search, realtime subscriptions and direct file access all returned nothing cross-tenant.
Internal review · Internal tenant isolation review, 23 July 2026
Candidates only become visible to a client organisation after an explicit approval for that organisation and role; releasing contact details is a separate permission again.
Verified in the platform · client_visibility gate on candidate matches
Realtime updates inherit the same policies, so a live subscription cannot deliver another organisation's changes.
Roles are stored separately from user profiles and checked server-side on every request.
Client roles are admin, editor and viewer. Admins manage the team, editors move candidates and roles forward, viewers can read what has been shared with them.
Internal review · Role and permission matrix
Platform roles (platform admin, operations) are separate from customer roles and are never granted by a customer-side action.
Verified in the platform · is_platform_staff helper + staff-only policies
Role checks run in SECURITY DEFINER functions with a fixed search path, which prevents a caller from redirecting the check to their own objects.
Verified in the platform · search_path pinned to public, extensions
Support access by platform staff runs as a bounded, expiring session; every action is written to a support-action log and to the change history with the real actor retained.
Sign-in is handled by the managed authentication service, not by hand-rolled code.
Email and password sign-in, with password reset by emailed link. Failed sign-in returns a single generic message so it cannot be used to confirm whether an address exists.
Verified in the platform · Sign-in route
Google sign-in is available on the client start flow.
Verified in the platform · Intake OAuth flow
Anonymous sign-up is disabled; an account is always tied to a verified identity and an organisation membership.
Verified in the platform · Auth configuration
Server-side requests re-validate the caller's session token on every protected call rather than trusting anything sent from the browser.
Verified in the platform · Authenticated server-function middleware
Membership can be deactivated by an organisation admin, and the change is recorded in the change history.
Internal review · Internal multi-organisation and revocation review
Encryption
Documented
Encryption is provided by the underlying infrastructure and described in the Privacy Notice. We restate it here rather than making separate claims of our own.
The published Privacy Notice records encryption in transit (TLS 1.3) and encryption at rest (AES-256) as technical measures applied by our infrastructure providers.
Published policy · Privacy Notice §7
CV files sit in private object storage and are only ever reachable through short-lived signed URLs generated after a permission check — verified in the codebase.
Verified in the platform · Private bucket + signed-URL download path
Provider-level cryptographic attestations are held by our infrastructure providers. We do not operate our own key management service and do not claim customer-managed keys.
Data retention
Policy in preparation
Retention periods are published, not negotiated case by case.
Candidate profiles: two years of inactivity, then deleted or anonymised unless consent is renewed.
Published policy · Privacy Notice §8
CVs and related artefacts: purged 90 days after a recruitment process concludes or after last use.
Published policy · Privacy Notice §8
Job submissions: anonymised for statistical purposes two years after a position is filled or closed.
Published policy · Privacy Notice §8
Audit and security logs: retained 12 months.
Published policy · Privacy Notice §8
Cross-position matching runs on consent for up to 12 months, and that consent can be withdrawn at any time.
Published policy · Privacy Notice §8
These periods are published policy and are honoured on request — a deletion or anonymisation request is recorded and actioned by the team. They are not yet enforced by a scheduled job, so a record may be held past its stated period until someone asks. Automating this is planned; until it ships, this section says so rather than implying the timers run themselves.
Audit coverage
Documented
Anything that changes a hiring record leaves a record of its own. Nobody can quietly rewrite history.
Database triggers write an audit event on insert, update and delete for memberships, organisations, positions, candidate matches, scoring runs, scoring decisions, client decisions, interviews, files and screening questions.
Domain actions that are not a plain row change — invitations, support sessions, publication decisions, membership deactivation, reconciliation runs — are written explicitly by the server.
Scoring runs are append-only: once written, a run and the evidence it used cannot be edited, only superseded by a new run.
Verified in the platform · Immutability triggers on score runs
Subprocessors
Documented
The register in the Privacy Notice reflects the infrastructure and vendors actually in use, with purpose, jurisdiction and transfer safeguard for each.
Currently disclosed: managed database, authentication, storage and realtime; edge hosting, CDN, WAF and DNS; payments and tax; analytics, tag management and the AI models used for CV parsing and scoring; transactional email; sourcing and contact enrichment; always-on business-visitor identification (legitimate interest); meeting scheduling; CRM; and productivity, mail and meetings.
Published policy · Privacy Notice §6
Material changes to the register are published before a new subprocessor begins processing candidate data.
Published policy · Privacy Notice §6
Questions or corrections about the register are welcome at privacy@taasflow.com.
Where processing takes place today, stated plainly.
Processing may take place in the European Union and the United States. Our managed database and storage run in those regions, and hosting, CDN and WAF run on a global edge network.
Published policy · Privacy Notice §7
International transfers rely on Standard Contractual Clauses, and on the EU-U.S. Data Privacy Framework with the UK Extension where a provider is certified under it. A Transfer Impact Assessment is maintained internally.
Published policy · Privacy Notice §7
We do not currently offer selectable or single-region residency, and we make no in-region-only guarantee. If residency is a requirement for your procurement, raise it with us before signing so we can answer against the real configuration.
Incident response
Policy in preparation
Incident response: policy in preparation. Operational runbooks exist and are used; the externally-facing policy is not yet published.
Fourteen operational runbooks cover the failure modes this system actually has — failed intake, CV parse failure, scoring failure, missing evidence, publication blockers, duplicate candidates, provider outage, email failure, realtime failure, access issues and migration problems.
Internal review · docs/runbooks 01–14
Any incorrect candidate visibility is treated as a security incident until proven otherwise: access is reconstructed from the change history, and affected users and trace IDs are recorded.
Provider outages are posted to the internal status view and affected tenants are notified.
Internal review · Runbook 10 — provider outage
Not yet published: an incident-response policy with customer notification timelines and severity definitions. We are not stating a notification time commitment until that document exists.
Business continuity
Policy in preparation
What we can verify today, and what is still being documented.
Database schema changes are applied as an ordered, reviewable migration history, which doubles as the record of what changed and when.
Verified in the platform · Migration history
Provider degradation has a defined operational response, including tenant notification.
Internal review · Runbook 10 — provider outage
Not yet published: backup and restore procedures, tested recovery objectives, and a disaster-recovery plan. We make no uptime guarantee, and we will not publish recovery targets before they have been tested.
What we do not claim
Documented
The fastest way to trust a security page is to see what it refuses to say. None of the following is true of TaaSFlow today, so none of it appears above.
No SOC 2, ISO 27001, HIPAA or PCI certification, and no audit report.
Internal review · No certification held
No completed third-party penetration test to publish.
Internal review · Not yet performed
No contractual uptime guarantee or published availability figure.
Internal review · No SLA published
No claim of full GDPR, CCPA or PDPL 'compliance' as a status. The Privacy Notice describes how we process data under those laws; it does not certify us.
Published policy · Privacy Notice §5
No automatic deletion. The retention periods above are published policy honoured on request, not timers enforced by a scheduled job — a record may be held past its stated period until someone asks.
Internal review · Not yet implemented
Privacy and legal documents
Documented
The underlying documents, with the date each was last updated.
Global Recruitment Privacy Notice — last updated 12 May 2026. Covers collection, legal bases, subprocessors, transfers, retention, candidate rights and AI-assisted scoring.
Published policy · /privacy
Terms of Service — last updated 5 March 2026. Covers the subscription model, client obligations, candidate-data handling, liability and termination.
Published policy · /terms
A Data Processing Agreement and a security questionnaire response pack are in progress. Ask us and we will send the current draft rather than a marketing summary.
You can export your candidate records at any time. Workspace access for a one-off package lasts three months; records are deleted after that unless you renew.
Candidate profiles, evidence and scores you have seen, available as an export.
Your role blueprints, rubrics and screening questions.
Every decision, comment and hire record, with a history of who changed what.
Every score points at a specific line in the CV or an answer to a screening question. If we cannot cite it, we do not score it.
A rubric per role
The rubric is built from your role brief: must-haves, preferred criteria and deal-breakers. You approve it before any candidate is scored.
A record of every score run
Each score is written to an append-only record with the rubric version and the evidence used.
Contradictions are flagged
When two pieces of evidence disagree, the candidate card shows the contradiction instead of picking a winner.
Questions buyers ask
What happens if we stop working with TaaSFlow?
You can export your candidate records at any time. Workspace access for a one-off package lasts three months; records are deleted after that unless you renew. There are no placement fees to unwind.
Can the software hire or reject a candidate?
No. No candidate is rejected or advanced by software alone. Scores support a person’s decision; they do not make it. A recruiter reviews every shortlist and your team makes the decisions.
What if we already have an ATS?
The TaaSFlow workspace includes its own applicant tracking. Direct sync with an external ATS is planned, not built. You can export your candidate records at any time.
Where does our data live?
In your organisation's workspace on managed infrastructure. The database enforces who can read what with row-level security, and candidate files sit in private storage. The sections above give the detail and the source for each statement.
Do you hold SOC 2, ISO 27001 or HIPAA certification?
We do not claim SOC 2, ISO 27001, HIPAA, or full GDPR, CCPA or PDPL compliance. See the security page for what we do and do not hold. TaaSFlow holds no HIPAA certification, and no SOC 2 or ISO 27001 certification.
Security contact
A real person reads these. Use the closest match rather than a general enquiry form.
There is no separate security mailbox yet. Vulnerability reports go to the same privacy@taasflow.com mailbox as privacy requests, so please put "Security report" in the subject line.
Report a suspected vulnerability here. Please include enough detail to reproduce it, and give us a reasonable window before disclosing publicly. We do not run a paid bounty programme.
