Loading…
Security
Enterprise-grade security
Your data deserves the highest level of protection. HireFlow360 is SOC 2 Type II with AES-256 encryption, comprehensive audit logging, and defense in depth across every layer.
Compliance & certifications
Third-party audited and independently verified.
SOC 2 Type II
Annual audit covering security, availability, processing integrity, confidentiality, and privacy controls.
GDPR compliant
Full compliance with the EU General Data Protection Regulation, including data portability and right to erasure.
HIPAA ready
Business Associate Agreements available. Healthcare-grade data protection for clinical hiring workflows.
CCPA compliant
Full compliance with the California Consumer Privacy Act, including opt-out and data-deletion rights.
ISO 27001
Information security management system certification (in progress, expected Q3 2026).
FedRAMP ready
Federal Risk and Authorization Management Program alignment for government agencies.
How we protect your data
Defense in depth across every layer of the platform.
AES-256 encryption
All data encrypted at rest using AES-256. Data in transit protected with TLS 1.3. Vault data uses additional vault-specific encryption keys.
SSO & SCIM
Enterprise SSO via SAML 2.0 and OpenID Connect. SCIM provisioning for automated user lifecycle management.
Multi-factor auth
MFA enforced for all accounts. Support for TOTP, hardware keys (FIDO2/WebAuthn), and push-based authentication.
Audit logging
Comprehensive audit trail of all user actions, API calls, and system events. Logs retained for 7 years and exportable.
Penetration testing
Annual third-party penetration testing by independent security firms. Continuous vulnerability scanning and a bug bounty program.
Network security
Infrastructure hosted on hardened cloud with VPC isolation, WAF protection, DDoS mitigation, and geo-restricted access controls.
Backup & recovery
Automated backups with point-in-time recovery. Multi-region replication with RPO under 1 hour and RTO under 4 hours.
Role-based access
Granular RBAC with principle of least privilege. Custom roles, IP allowlisting, and session-management controls.
Secure development
OWASP-aligned SDLC with code reviews, static analysis, dependency scanning, and container image scanning in CI/CD.
Data handling practices
Data processed and stored in the US, with an EU region available
No personal data sold to third parties, ever
Data deletion within 30 days of request
Consent-based data sharing with granular controls
Data Processing Agreements (DPA) available for all customers
Annual security-awareness training for all employees
Background checks for all employees with data access
Incident response plan with a 24-hour notification SLA
Questions about security?
We're happy to provide our SOC 2 report, complete security questionnaires, or schedule a call with our security team. Email security@hireflow360.com.