The engineering answer to how your candidate data is protected

All traffic between a browser, the recruiter mobile app and the platform runs over TLS. Traffic between the platform and its subprocessors - the messaging providers, the job boards, the calendar services - runs over TLS as well, and credentials for those services are held in a managed secret store rather than in environment files checked into a repository.

At rest, the primary database, object storage and backups are encrypted. Particular categories are handled more tightly than the general record: demographic data collected for equal-opportunity reporting is stored apart from the hiring record and is not exposed to recruiter roles at all, and call recordings carry per-tenant retention limits so audio does not accumulate indefinitely because nobody set a policy.

Permissions are role-based and field-level, not just page-level. A recruiter sees the pipeline they work; a desk lead sees the team; an owner sees billing. Compensation history, demographic fields and client margin can each be restricted independently, which is what lets a firm give a contractor or a temporary sourcer access to the database without exposing commercial data.

Internally, staff access to production is scoped and logged. Nobody holds standing access to customer data for convenience, support access is granted for a defined purpose and is visible in the audit trail, and administrative actions are separated from routine ones. Enterprise accounts can require SSO and SAML so that identity, offboarding and password policy stay in the customer's own directory rather than in ours.

Every stage change, disposition, permission change, export, deletion and message send is written to an audit trail with the actor, the timestamp and the reason code. Dispositions are a fixed list rather than free text precisely so that the record reconstructs a decision months later, which is what an equal-opportunity audit or a client dispute actually requires.

Automated actions land in the same log as human ones. When an AI agent scores a candidate, drafts an outreach message or moves a record, the entry names the agent, the model operation and the user on whose behalf it acted. There is no separate, quieter log for machine activity - that is the point of having one trail.

Audit records are append-only. A user with administrative rights can read them and export them; they cannot rewrite them.

Encrypted backups run on a schedule with point-in-time recovery on the primary database. Object storage is versioned so that a deletion or an overwrite is recoverable inside the retention window rather than final at the moment somebody clicks.

A backup nobody has restored is a hypothesis, not a control. Restores are exercised on a recurring schedule into an isolated environment, and the exercise checks that tenant boundaries survive the restore - a restored dataset that mixes tenants is a breach, not a recovery. Findings from those exercises feed the same tracker as security findings.

Surhires depends on other companies to send a WhatsApp message, post a job, place a call, transcribe a recording, run a model or take a payment. Each of those is a subprocessor with access to some category of customer data, and each is named in the published subprocessor register with what it processes and where.

Adding one is a change customers are told about rather than a detail buried in a terms update. Where a subprocessor introduces a data-residency implication - a model provider operating in a different region, for instance - the register says so, because that is the fact a data protection officer needs and it is precisely the fact that vendors tend to leave out.

Dependencies are monitored for known vulnerabilities and patched on a severity-driven schedule rather than whenever a release happens to be due. Findings from internal review, from customer security questionnaires and from external reports all enter the same tracker with an owner and a target date, so nothing survives by being reported through an unusual channel.

If you find a vulnerability, write to [email protected] with enough detail to reproduce it. Reports are acknowledged and triaged, and a reporter who acts in good faith - no data exfiltration beyond what proves the issue, no service degradation, no access to another tenant's records beyond demonstrating that access is possible - will not be pursued. There is no paid bug bounty programme at present, and this page will not pretend otherwise.

The wording used here is the wording used everywhere on this site: a readiness programme is under way with continuous control monitoring. A Type I report is the first deliverable; we do not claim a Type II report until one has been issued and we will publish the report date when it is.

That distinction gets blurred constantly in this category. A Type I report describes whether controls are suitably designed at a point in time. A Type II report describes whether they operated effectively over a period, usually three to twelve months, and it is the one most enterprise procurement teams actually want. Claiming the second while holding the first is a misrepresentation that a competent reviewer catches, and it poisons every other statement a vendor makes.

An independent third-party penetration test and a tenant-boundary review are being commissioned ahead of general availability. The tenant-boundary component is specified separately from the general test because it is the failure mode with the worst consequences for a staffing platform, and a generic web application test does not necessarily probe it.

The result will be published. Not the raw report, which would itself be a disclosure risk, but the scope, the date, the testing firm, the severity distribution of findings and the remediation status of each. A summary that reports only that a test was performed tells a buyer nothing; a summary that reports what was found and what was fixed is the one worth reading.

Until that work is complete, this page describes controls that are implemented and names the ones that are not yet independently verified. Treat the difference as material, because it is.