Security
Built to protect candidate and company data
Hiring data is personal data. Here’s how OneATS keeps it safe — described plainly, without jargon.
Encryption in transit
- All traffic is served over HTTPS with HTTP Strict Transport Security.
- A Content Security Policy and framing protection guard against injected scripts and clickjacking.
Tenant isolation
- Every company’s data is scoped to that company on every request.
- Scoping fails closed: a request without a valid company scope is refused rather than widened.
Role-based access
- Admins and recruiters see only what their role allows; recruiters are limited to their assigned work.
- Candidates have their own separate role and can only reach their own data.
Account protection
- Strong password rules that reject common and easily guessed passwords.
- Rate limiting and account lockout on sign-in to slow down password guessing.
- Sessions are kept in httpOnly cookies that page scripts cannot read.
Protected integration secrets
- Credentials for calendars, video and job boards are encrypted before they are stored.
- Secrets are never sent back to the browser once saved.
Audit logging
- Sensitive actions — such as data exports and support access to a company — are recorded in an audit log.
- Bulk exports are constrained and logged.
Candidate privacy & erasure
- Candidates can delete their account at any time.
- Deletion erases their resume and personal data, and anonymises past applications so employers’ records stay consistent — in line with the DPDP Act 2023 and GDPR right to erasure.
Report a security issue
If you believe you’ve found a vulnerability in OneATS, please email [email protected] with the details. Please give us reasonable time to investigate and fix it before disclosing it publicly.
Questions about security?
Our team is happy to walk you through how OneATS handles your data.