Security

We're asking to hold employment contracts and payslips. Here's exactly how we handle that.

No badges, no percentages, no reassuring vagueness. What follows is a plain description of how the system is built and what it protects.

What's actually in here

Being specific about this is the point. If you're evaluating us, you should be able to see the whole surface at once.

Category	What that means in practice
Candidate data	CVs and the text extracted from them, contact details, application history, interview notes, scorecards, assessment results, reference responses
Employment records	Signed contracts, identity and right-to-work documents, salary and bonus figures, payslips, bank and payment details, tax dependants, leave and sick-leave records
Commercial data	Client companies and contacts, proposals and rates, placement terms, invoices, margin and cost figures, recruiter commissions
Operational data	Equipment assignments, third-party system access records, timesheets, goals and review notes
Communications	Messages sent to candidates and employees across every channel, and replies received back into the system

Some of this is among the most sensitive data a company holds about a person. We treat the whole set at that level rather than tiering it.

Your workspace is separate, at the query level

Every record carries your workspace identity, and data access is scoped to it automatically rather than by each screen remembering to filter.
Your workspace has its own address, and sign-in happens there. There is no shared login page that could route someone into the wrong workspace.
Sessions, password resets and invitations are all scoped to your workspace. A reset link issued for one workspace cannot be used against another.
The same email address can exist independently in different workspaces without the accounts being connected in any way.

Recruiters, HR, finance, your employees and your clients can share one system safely

This is what keeps a system this broad usable instead of alarming. Access is controlled at three levels.

Roles. Distinct roles covering administrators, managers, HR, recruiters, IT, employees and client contacts - each seeing a different system.
Per-module permissions. View and edit rights are granted separately, module by module: candidates, jobs, employees, equipment, finance, companies, settings, reports and audit logs are all independently controlled.
Protected actions. The consequential things - terminating someone, approving payroll, sending a client invoice, making a final offer decision - are restricted at the point of action, so they cannot be reached by a user who shouldn't reach them even by direct link.

Your employees see only themselves. The self-service portal is a separate surface with its own boundary - an employee filing a timesheet has no path to anyone else's records.

Your clients see only their own people, through a portal scoped to their company, with every view and action recorded.

Authentication

Two-factor authentication is required for every administrative user - set up on first sign-in, not an option buried in settings. Codes come from an authenticator app, with email as a fallback.
Bot protection on sign-in that scores the request instead of setting a puzzle, so real people aren't slowed down.
Rate limiting on every public endpoint - sign-in, password reset, and every one of the link-based pages a candidate, client or employee might use.
Link-based pages carry single-purpose tokens. A signing link, a booking page, an offboarding confirmation or a survey opens exactly one thing and grants no wider access.
Passwords are hashed, never stored or recoverable, and never sent to you in an email.
Third-party credentials are encrypted at rest - messaging tokens, calendar tokens and webhook secrets. Where a credential has to be matched on lookup, it's stored as a one-way hash instead.

Employees who only use the self-service portal aren't required to set up two-factor, because they have no access to anyone's records but their own. Every user who can see other people's data is.

Everything is written down

A change log recording what was modified, by whom, and when.
An access log recording who looked at what - separately from who changed it.
A communication log covering every message sent on any channel, with recipient, subject and delivery outcome.
Signed acceptances for equipment handover, contracts and offers - held against the record, not in an inbox.
Confirmed offboarding. When someone leaves, each third-party system they had access to is confirmed closed, on the record, by the person who closed it.

Administrators can read both logs in the app, and they're covered by the same export rights as everything else.

It's yours, and leaving is easy on purpose

Full export on demand, on every plan, without asking us.
Scheduled export to storage you own, so you always hold a current copy.
Deletion on request, at any time, including for an individual person's records.
We don't sell data, share it between workspaces, or use your data to build anything.

Found something?

Email security@easycruiter.com and you'll get a human reply within one business day. We won't threaten you, we'll tell you what we did about it, and we'll credit you if you'd like.

If you're testing, please use your own trial workspace and don't touch anyone else's data. That's the only rule.

How we use AI → Ask us something →