Security and compliance
Answers for your legal and IT reviewers
How Recrutar keeps your data apart, keeps hiring fair, and is built for the rules on AI in hiring. Plain answers, because vague ones stall a security review.
Your data
One workspace cannot see another
The database itself keeps each workspace’s data apart, on every read. It does not rely on the app remembering to filter.
Checked by the database, every time
When someone signs in, the database returns only their own workspace’s data, whatever a page asks for (row-level security). Background work has to name the workspace on every operation, so a missing filter is caught while the code is written rather than becoming a leak between customers.
This is checked whenever the database changes: a new table without workspace separation switched on is refused.
Each link does one job, and expires
A colleague reviewing a job description, a candidate opening their interview or a test: each uses a link that does one job, expires, and can be cancelled. Only a fingerprint (hash) of each link is stored, never the link itself. A link that no longer works says the same thing whether it expired, was cancelled or never existed, so nobody can test which links are real.
Fairness
Personal characteristics never reach a score
This is built into Recrutar, not a setting someone has to remember. Scoring has no way to read this data.
Why this matters
What candidates tell you about themselves
If a candidate shares details such as gender or nationality with Recrutar, they are stored apart from everything scoring can reach. Only the combined fairness report reads them. It shows whether your hiring as a whole disadvantaged any group, and it cannot be used to look anyone up.
What your ATS recorded on its application form is shown only on that candidate’s own page, to your recruiters and admins. Otherwise only the combined fairness report reads it. It is never a column, a sort, a filter, a score or a reason to select anyone.
Filters use facts about the work
A filter can only use a fixed list of facts: right to work, visa sponsorship, location, willingness to relocate, notice period, employment type, education level, institutions, years of experience, licences, a language at a given level, and expected salary. The options on screen come from that list, so a filter on a personal characteristic cannot be set up at all. The right to work in a country is a requirement of the role. Being a national of it is not.
External search keeps work details only
Your own applicants come first. External search uses one licensed database of professional profiles, only when you ask. It keeps work details only: never personal details such as age or gender, a personal email or a phone number. We never scrape a site.
Regulation
What each law asks, and our answer
EU AI Act
AI used in hiring is high-risk. Inferring emotions at work is banned under Article 5(1)(f), in force since February 2025 with no grace period. Recrutar scores only the substance of an answer: never emotion, tone or facial expression. Accent, fluency and pace are never scored either. Where a role needs a language, the interview asks what the candidate has used it for.
NYC Local Law 144
An automated hiring tool needs a yearly bias audit. Recrutar counts selection rates from what candidates choose to share, in the categories the law names, and never from a guess about anyone. Scoring cannot read those details at all, so the audit measures the tool that actually ran.
GDPR
Using your own applicants relies on the lawful basis you already hold for them. External search, if you use it, keeps work details only: never personal details such as age or gender, a personal email or a phone number. No protected characteristic is guessed anywhere in Recrutar, so no special-category data is created by guessing. The reasons for each decision are recorded at the time, so a candidate who asks why can be given them.
Uniform Guidelines on Employee Selection Procedures
A test is a selection procedure, so every question must relate to the role. Each question is tied to one of the role’s requirements, and a generated question that is not is thrown away. A blank answer counts as wrong, so skipping a hard question never helps.
Human oversight
Autopilot moves candidates forward. It never rejects anyone.
A wrong move forward costs one more review. A wrong rejection can lose a good candidate for good. So the two are treated differently.
Automatic rejection is off
It stays off unless you switch it on. Switching it on needs a sample that a person reviews, and time to undo each rejection. A round marked as needing approval never moves anyone on without a person.
You approve what Autopilot sends
By default, Autopilot’s invitations and every rejection email wait for a person to press Send. Only an admin can turn this off.
No result is not a no
If an interview has no result yet, the candidate waits or goes to a person. A missing result never becomes a rejection.
Everyone filtered out is counted
Each candidate a filter removes is listed with the reason. A CV that could not be read is listed below the others with a note. That is a problem with the file, not evidence about the person.
Straight answers
Where things stand today
Certification
Recrutar is not SOC 2 certified today. Ask us where that stands and what controls are in place, and you will get a straight answer in writing, not a badge on a web page.
Where your data is kept
Where your data is stored and processed is agreed with each customer. We put it in writing before you sign rather than implying a region here.
Sub-processors and agreements
The current sub-processor list, the data processing agreement and the AI transparency notice are kept as documents, and we send them on request. See sub-processors and data processing.
Reporting a vulnerability
Email sales@recrutar.ai with “security” in the subject. We will confirm we received it and tell you what we found, even when the answer is that we were wrong.
Bring your security reviewer to the call
These questions are easier to answer live, in the product, than in a questionnaire.