Data minimization
The application is designed for candidate name, email, jurisdiction, job reference, linked hiring tool, notice status, and delivery events. It excludes resumes, Social Security numbers, demographic data, assessment scores, interview notes, background checks, and medical data.
Workspace separation
Customer records are tenant-scoped. Application access checks and database policies are designed to limit records to authorized members of the relevant customer workspace.
Access controls
Roles control access to sensitive actions. Owners and administrators can enable multi-factor authentication. Billing actions are restricted to the workspace owner.
Record integrity
Notice, delivery, consent, and audit events are designed as append-only application records. The application distinguishes a send/provider-accept response from later delivery or failure events.
Controlled sends
A notice cannot be sent from an unapproved template version. Template approval requires a recorded attorney review; customers remain responsible for their approved language and legal decisions.
Protected integrations
Outbound-provider and billing webhooks are validated before the application processes them. Sensitive service credentials are kept server-side rather than exposed in the browser.