HIROBIA

Security and trust

Hiring data is personal. This page explains how we protect it, how we use AI in hiring, and how we keep the service running. Last updated 15 October 2026.

Compliance status: we are preparing for a SOC 2 audit and an independent penetration test. We do not yet hold a SOC 2 report or a penetration test summary.
System status →Is everything working now, and uptime over 90 daysSubprocessors →Who processes data for us, what for, and where

Your data stays yours

  • Every company's data is kept separate. Each request is checked against the signed-in person's organization and role, and the database itself refuses access across organizations (row-level security).
  • Roles limit what people can do: admins, recruiters, hiring managers who see only the jobs they are on, read-only viewers, and auditors who see only the audit log and compliance reports.
  • Candidate resumes and interview recordings are stored in private storage and opened only through short-lived links.

Sign-in and access

  • Single sign-on (OIDC: Okta, Microsoft Entra ID, Google) is available, and a company can require it for all its members.
  • Two-step verification is available to everyone and can be required for a whole organization.
  • Users can be created, updated and removed automatically from your identity provider (SCIM). Removing someone signs them out everywhere at once.
  • Admins can set an idle timeout and an IP address allowlist, see who is signed in, and sign people out. Everyone can see and end their own sessions.
  • Password rules are enforced, sign-in attempts are rate limited, and changing an email or password needs the current password.

Protection in transit and at rest

  • Traffic to HIROBIA is encrypted with HTTPS and browsers are told to insist on it.
  • Our database and file storage providers encrypt stored data.
  • Credentials you connect (calendar, email, job-board and recruiting-system connections) are stored encrypted.
  • We never store card numbers. Payments are handled by Razorpay.

Visibility and control

  • An audit log records who did what and when, including sign-ins, role changes, settings, score overrides and exports. Admins and auditors can search and export it, and stream it to your own security tools (SIEM) over a signed connection.
  • Each company chooses how long resumes, interview recordings and transcripts are kept, separately; older data is deleted automatically.
  • Candidates can ask for a copy of their data, or for it to be deleted, from their own status page. Admins can also export or permanently erase everything held about a person.
  • Applicants see a clear consent notice and a privacy notice before they apply or are interviewed.

Responsible AI in hiring

  • The AI never rejects anyone. A person reviews every AI interview score and can change it with a reason; every change is logged.
  • Each score records which AI models, prompts and scoring rubric produced it, so a decision can be traced and reproduced.
  • Candidates are told that an AI conducts the interview and choose whether it may be recorded before it starts.
  • Candidates who cannot use voice or video, or who had a problem during their interview, can ask for an accommodation or another attempt. A person answers every request.
  • An interview a candidate leaves partway is never scored automatically; the recruiter decides whether to re-invite them or score what they answered.

Reliability

  • Every part of the service is health-checked every 5 minutes, and the results are public on our status page. Our uptime target is 99.9% a month.
  • Our team is alerted when interview scoring or resume processing is delayed.
  • Errors are tracked centrally with personal data removed first: no email addresses, phone numbers or tokens leave the service in error reports.

How we build and operate

  • Every code change is tested automatically and scanned for vulnerable dependencies and leaked secrets before it ships.
  • Database changes are made through tracked migrations, tried on a test environment first.
  • We keep an incident response plan. If an incident affects your data, we tell you without undue delay and give you what you need to meet your own obligations.

Documents on request

  • Data processing agreement (DPA)
  • Answers to security questionnaires (SIG Lite, CAIQ)
  • A description of our security policies

Ask your HIROBIA account team.

Report a security issue

Contact your HIROBIA account team with details. We will acknowledge your report and keep you updated.