// trust
Security
How we protect candidate and company data across the platform.
Last updated: August 30, 2026
Security is foundational to a platform that processes résumés, code activity, and hiring decisions. This page summarizes our current practices. We’re a small team moving fast — if you find a gap, we want to hear about it.
Data protection
- Encryption in transit: all traffic is served over HTTPS/TLS.
- Encryption at rest: our managed database and object storage encrypt data at rest.
- Secrets management: credentials are stored as environment secrets, never in source control, and scoped per environment.
Access control
- Authentication via OAuth (GitHub) and session-based auth with least-privilege scopes.
- Recruiter access to candidate data is gated by verified company membership and enforced at the API layer.
- Résumé files are served through access-guarded, expiring links — never public URLs.
- Internal access to production data is limited to what is necessary to operate the service.
Application security
- Strict Content-Security-Policy and standard security headers.
- Rate limiting on authentication, submissions, and expensive AI endpoints.
- Input validation on all API boundaries (typed schemas end to end).
- Automated ranking decisions are logged for auditability and bias monitoring.
Infrastructure
Hyrrd runs on established cloud providers (Vercel for hosting, a managed Postgres database, and Cloudflare R2 for file storage). These providers maintain their own compliance programs (e.g. SOC 2). Each provider that processes personal data is bound by a data-processing agreement.
Monitoring
We monitor application errors and background-job failures and alert our team on anomalies. We are actively expanding our observability coverage ahead of general availability.
Responsible disclosure
If you believe you’ve found a security vulnerability, please email security@hyrrd.tech with details and steps to reproduce. Please give us a reasonable window to remediate before public disclosure. We won’t pursue legal action against good-faith research that respects user privacy and avoids service disruption.
Roadmap
As we approach general availability we are formalizing our incident-response process, expanding audit logging, and pursuing third-party security review. This page will be updated as those milestones land.