Our candidate data policy
Candidate data is personal information. We process it under the India Digital Personal Data Protection Act 2023, encrypt it, and let candidates request deletion at any time.
Our commitment on every account
Encrypted in transit and at rest
Data moving between your browser, our servers, and integrations uses TLS 1.2 or higher. Stored candidate data uses AES-256 encryption at rest. Keys are managed separately from the data they protect.
Candidate data never trains models
Candidate responses, resumes, and profile information are never used to train, fine-tune, or evaluate machine learning models. Your candidates' data remains yours. It informs your scoring rubric, not any model we or a third party operates.
Candidate deletion rights
Under the DPDP Act 2023, candidates may request deletion of their personal data. We process and confirm requests within 30 days. Deleted records are removed from our systems and integrated ATS records where technically feasible.
Access controls
Role-based access controls determine which team members can view candidate records, scores, and responses. Account admins manage permissions. We log candidate-record access events with timestamp and user identity.
Data residency
Primary production data is stored in cloud infrastructure within India. Backup replication may use nearby regions in line with DPDP Act guidelines. We do not transfer candidate personal data outside India without explicit consent.
Internal controls
Our security controls align with SOC 2 Type II principles, including logical access, change management, and incident response. We are working toward formal third-party certification. Controls are implemented, but the audit is not yet completed.
India DPDP Act 2023 for recruiting data
The Digital Personal Data Protection Act 2023 covers personal data processing for individuals in India. Candidate data collected and processed through HireBoundless falls under this framework.
As a data processor acting for our customers (data fiduciaries), HireBoundless processes candidate data only for purposes set out in our Data Processing Agreement. We do not process it beyond what is needed for the recruiting pipeline functions our platform provides.
We implement purpose limitation, data minimization, storage limitation, and candidates' rights to access and erase their data. Our Privacy Policy details these rights. Our Terms of Service governs the data processing relationship between HireBoundless and our customers.
Discuss your data requirements
Questions about data residency, deletion procedures, or integration data flows? Our team will provide detailed answers.