Identity and access
Authentication, verification, sessions, roles, scopes, and permission changes are checked before protected work is returned or changed.
HireHint security
Security that follows every people workflow.
HireHint protects recruiting, employee, and intelligence work with layered access, tenant isolation, and fail-safe product controls.Layered protection
Controls work together, not in isolation.
Workspace isolation
Organization ownership is resolved at protected boundaries so one tenant cannot use a visible route or direct request to read another tenant’s records.
Safe operations
Validation, idempotency, audit history, bounded data access, and explicit provider states help the product fail safely and recover clearly.
Current product controls
Protection across HireHint.
This overview describes product behavior. It does not claim an external certification, audit opinion, uptime commitment, or provider assurance.Authentication and sessions
Password and provider sign-in flows, email-verification boundaries, session expiry, direct-route protection, and refreshed permission checks.
Roles and scopes
Account, recruiting, HR, job, department, entity, location, reporting-line, and record-level access is evaluated according to the active identity.
Tenant and record boundaries
Sensitive reads and writes resolve the active organization, ownership, record state, and requested action before protected information is returned or changed.
Validation and safe failure
Requests are validated at the service boundary. Missing, denied, stale, duplicate, and ineligible operations produce bounded outcomes without exposing another tenant’s protected resource.
Audit and accountability
Security-relevant and operational changes connect the authorized actor, organization, action, record, and outcome so teams can investigate and reconcile activity.
Secure development gates
Architecture, security, generated contract, database, migration, dependency, client, server, build, browser, and visual checks guard reviewed behavior before a release is considered complete.
Dependencies and source review
Automated checks inspect dependency advisories, secret patterns, security-sensitive source paths, generated inventories, and approved architecture boundaries.
Database changes
Migrations and data-access paths are reviewed and tested against protected disposable databases so schema and permission behavior can be verified without relying on historical customer data.
Integrations and outbound actions
Provider-dependent controls remain unavailable until configured and authorized. HireHint distinguishes catalog, ready, active, failed, and deferred states and does not treat a visible control as evidence that an external action occurred.
AI boundaries
AI assistance uses permission-scoped context, discloses missing evidence, and does not silently execute legal, candidate, or employee actions.
Recovery boundaries
Failure and recovery behavior is exercised in controlled environments. Production hosting, backup retention, recovery objectives, failover, and disaster-recovery claims require separate operational evidence and approval.
Customer controls
Organization owners can limit membership, roles, scopes, assignments, confidential access, connected services, and records according to the people and workflows that require them.
Security lifecycle
Prevent, detect, respond, and recover.
Controls are designed as a continuous operating loop, with explicit states and evidence at each boundary.Prevent
Authenticate identities, minimize access, validate requests, isolate organizations, and require explicit configuration before sensitive or external actions.
Detect
Record security and operational outcomes, surface errors without leaking protected content, and use reviewed checks to identify contract or dependency drift.
Respond
Restrict affected identities, routes, records, providers, or actions; preserve relevant evidence; communicate through an approved incident process.
Recover
Restore supported service state, reconcile durable outcomes, re-check permissions, and verify recovery before returning a control to normal use.
Shared responsibility
Security continues inside every workspace.
HireHint provides product controls; customers and authorized users apply them to their people, devices, records, providers, and decisions.
- Use individual accounts, strong authentication, secure devices, and approved recovery methods.
- Grant the smallest role, scope, job assignment, reporting-line access, and additional permission required.
- Review memberships and remove access promptly when a person changes roles, becomes inactive, or leaves.
- Protect exports, downloaded files, copied links, connected services, email domains, and endpoints outside HireHint.
- Review candidate, employee, report, and AI-assisted information before a consequential action.
- Report suspected unauthorized access or a security concern through HireHint Support without sending passwords or authentication codes.
Trust through evidence
Verified claims only.
Current assurance boundary
HireHint should publish certification badges, infrastructure claims, provider assurances, penetration-test statements, hosting regions, uptime levels, and recovery commitments only after the corresponding evidence is independently established and approved for external use.
This page describes verified product-control intent and tested structural behavior. It does not represent an external audit opinion, security certification, production hosting attestation, or service-level agreement.
Ask a security question