How your files are stored and protected

OneATS stores resumes, application documents, generated letters and onboarding ID proofs in dedicated cloud storage with multiple layers of encryption and strict role-based access checks.

Where files are kept

• All files are stored in Amazon S3 in the AWS Mumbai region (ap-south-1).
• Every bucket blocks public access by default; requests must use HTTPS and only the OneATS application can read files.
• Each company's files are kept in their own folder, organised by type, year and month, ensuring strict separation.

How they're encrypted

• Resumes, job attachments and documents are encrypted at rest with a dedicated key in AWS Key Management Service (KMS), managed by OneATS.
• Government ID documents (Aadhaar, PAN, bank proofs and payslips) are kept in a separate store with their own KMS key.
• OneATS also encrypts each ID document and offer letter with AES-256-GCM before uploading, so these files are encrypted twice.
• Public brand media (company logos, banners and recruiter avatars) are stored with AES-256 encryption and served through OneATS.

Who can open them

• Files are never shared as direct or public cloud links.
• Every resume and document download is checked by OneATS against the person's session, company and role. Logos and other images shown on careers pages are public by design.
• For Aadhaar cards, automated OCR generates a masked preview. Only designated Company Admins can open the original file, and every view is recorded in the Audit Log.
• Access to private and ID storage is logged, and logs are kept for 90 days.

Automatic compression

• Uploaded PDFs are compressed automatically in the background. OneATS keeps the smaller copy only if it is at least 10% smaller, every page is still there and its text still reads.
• The file URL and identifier stay identical, so no links change.
• Profile photos and company logos can be up to 500 KB and are resized automatically in the browser before upload.

Deleting files and candidate erasure

When a candidate's data is erased, or when a company's retention rule or the Free plan's 2-year limit removes old records, OneATS deletes their resumes and documents from storage. A deleted file's previous version is kept for up to 7 days for recovery, then removed automatically.

Last reviewed: 11 November 2026