Candidate data is sensitive. We treat it that way.
Hosted in Mumbai, isolated per organisation, encrypted in transit and at rest, backed up nightly, and never used to train anything. Here is the detail.
- Mumbai
- AWS region, data in India
- AES-256
- at rest, TLS 1.2+ in transit
- 14 days
- of nightly backups
- 72 h
- incident notice
Browser or phone. Google sign-in or email and password. Candidate links expire.
Every query carries the organisation key. Roles checked on every action. Audit log, append-only.
PostgreSQL, encrypted at rest, private network only. Nightly backups kept 14 days.
Resumes and documents in private object storage, served through signed, time-limited links.
Receives resume text to extract fields, under terms that exclude training. Nothing is pooled across customers.
Infrastructure
- Hosted in India
- Amazon Web Services, Mumbai region. Data does not leave the country.
- Encrypted everywhere
- TLS 1.2+ with HSTS in transit; encryption at rest for the database and every file.
- Backed up nightly
- Database and files, kept off the server in versioned storage, with tested restores.
Application
- One tenant, one boundary
- Every row carries the organisation key and it is enforced in the data layer, not per screen.
- Roles that fit your org
- Owner, admin, recruiter, agency recruiter, view-only consultant and employee, with features switched on or off per role. Agencies see only the roles you share and their own submissions.
- Files are never public
- Resumes live in private object storage and are served only to signed-in members through time-limited links.
AI and data
- No training on your data
- Resume text is sent to the AI provider only to extract fields, under terms that exclude training.
- Nothing pooled
- Candidates are never shared or matched across customers.
- Export any time
- Your whole database in CSV whenever you want it. Delete candidates or close the organisation yourself.
Operations
- Audit log
- Who changed what, when and from where, append-only.
- Least privilege
- Production access is limited, logged and rotated. Secrets never live in the codebase.
- Incident notice
- Customers affected by an incident are told within 72 hours.
Compliance, honestly stated
We follow India's Digital Personal Data Protection Act in how we collect, store and delete candidate data, and we sign a data-processing agreement with customers who need one. ISO 27001 certification is in progress; we will publish the certificate here when it is issued. We do not claim certifications we do not hold.
Found a vulnerability? Write to privacy@hirezeta.io. We acknowledge within two business days and never act against good-faith research.
Set up in an afternoon. Hire from tomorrow.
Import your candidates, invite the team, post a role. Fourteen days free, every feature, no card.