Security
Updated 24 October 2026
HireAssist holds resumes, video answers and hiring notes, so employers and candidates need to know how that data is protected. This page describes how the product is built and run. It is deliberately plain: it lists what is in place today, not certifications we do not hold.
Separate organisations
HireAssist is multi-tenant. Every job, candidate, note, email and credit transaction belongs to exactly one organisation, and every request is checked against the organisation of the signed-in user. One customer cannot see another customer’s data, including through the public job board, which shows only what each employer has chosen to publish.
Access inside an organisation
- Team members have roles. Administrators manage billing, team membership and organisation settings; HR users work with jobs and candidates.
- Administrators can remove a team member at any time, which ends that person’s access immediately.
- Notes, tags, stage changes and every email sent to a candidate are kept on that candidate’s record, so the whole team can see what has been done.
Candidate access without passwords
Candidates never create a password. They track their application through a link that is unique to them, and open their dashboard through a magic link sent to the email address they applied with. Each link is unique to one candidate and cannot be used to reach anyone else’s application.
Payments
Credit packs are bought through Chargebee. Card and bank details are entered on Chargebee’s hosted checkout and are stored by Chargebee, which is PCI DSS compliant. HireAssist stores only the invoice, the pack bought and the resulting credit balance.
Data in transit and at rest
- All traffic between browsers and HireAssist, and between HireAssist and the services it uses, is encrypted with TLS.
- Resumes, recordings and transcripts are kept in access-controlled cloud storage and are served only through the application to a signed-in member of the owning organisation, or to the candidate through their own link.
AI processing
Resume parsing, scoring, quiz generation, transcription and evaluation are performed by AI model providers under contract. We send only the data needed for the specific task, and candidate data is not used to train models for other customers. When a model cannot evaluate an answer, the application marks it for manual review instead of guessing.
Email and calendar connections
Reply tracking uses a mailbox an employer chooses to connect over IMAP, and it is used only to read replies to emails sent from HireAssist. Disconnecting the mailbox stops the access. Google Calendar and Meet are connected through Google’s own authorisation flow with the minimum scopes needed to create interview events, and the connection can be revoked at any time from Google’s account settings or from HireAssist.
Deleting data
Employers can archive or delete candidates at any time, and can close their organisation, after which its data is removed as described in the privacy policy. Details and timelines are in the privacy policy.
Reporting a vulnerability
If you find a security issue in HireAssist, email Info@bdatechnologies.comwith the subject “Security report” and enough detail to reproduce it. We acknowledge reports within 2 business days, keep you informed while we fix the issue, and will not take legal action against good-faith research that avoids accessing other people’s data, degrading the service or making findings public before a fix is released.
Questions
For security questionnaires or questions about a specific control, write to Info@bdatechnologies.com.