Product update November 7, 2026 8 min read

How SohamRecruit handles candidate data: security and privacy, explained

Where SohamRecruit stores agency and candidate data, how access is controlled, what our Privacy Policy commits to, and what we do not claim — including that we are not SOC 2 or ISO 27001 certified today.

Google Cloud, us-central1
One agency, one tenant
Export, delete, and audit
Not SOC 2 or ISO 27001

Recruitment agencies sit on sensitive information every day — résumés, phone numbers, salary expectations, client feedback, and placement history. Clients and candidates ask the same questions: where does this data live, who can see it, and what happens when someone asks for a copy or a deletion?

This post is a clear, factual answer for staffing-agency owners and admins. It is based on what we publish today on our Security, Privacy Policy, Terms, DPDP, FAQ, and help pages. It is not a certification claim and not a comparison with other ATS products.

Why agencies care about candidate-data privacy

When your agency uploads a CV, you are usually the data controller (or, under India’s DPDP Act, the Data Fiduciary). SohamRecruit acts as a data processor: we store and process that data to run the product for you, and we do not sell it.

Clients may ask how you protect shortlists. A candidate may request a copy of their data or ask to be erased. Regulators may expect you to know where records are hosted. The ATS you use should make those answers easy — export, delete, isolate tenants, and keep an audit trail — without wrapping basic hygiene behind enterprise sales theatre.

Where SohamRecruit runs

SohamRecruit is hosted on Google Cloud Platform in the us-central1 region (Council Bluffs, Iowa, United States):

Application hosting on Cloud Run
Database on Cloud SQL for PostgreSQL
Résumé files and other uploads in a private Google Cloud Storage bucket, served only through short-lived signed URLs — not anonymous public links

If you need data stored in a specific country, contact us before you sign up. We do not currently offer alternative hosting regions. For transfers from the EEA, UK, or Switzerland, our Privacy Policy states that we rely on the European Commission’s Standard Contractual Clauses (SCCs) with Google Cloud.

How access and workspace controls work

One agency, one tenant. Every company account is a separate tenant. Multi-tenant isolation ensures a query or API call only sees that agency’s rows. Cross-tenant access is blocked. Client portal users only see what you share for their client company.

Roles. Inside an agency: company admin, recruiter, business development, and client-portal users. Admins invite teammates from Users; each person gets their own login.

Sign-in. Passwords are stored only as bcrypt hashes. Sessions use secure, HTTP-only cookies that expire after eight hours. After five wrong passwords in ten minutes, an account is locked for fifteen minutes. Sign-up, sign-in, and password reset are protected by Google reCAPTCHA and rate limits. New accounts must verify email before they can send email, invite people, or manage billing.

Activity and audit logs. Changes to candidate records are kept in an activity log; administrative actions in an audit log. Every plan keeps each candidate’s own history. Starter includes an activity and email log for the last 30 days. Pro includes the company-wide audit (activity) log, plus the Data API and webhooks. Our Privacy Policy states that activity-log entries for candidate-record changes are retained for five years, then automatically deleted. Core candidate and job records stay while the account is active and are removed when you delete a candidate or the account.

Encryption. All traffic uses HTTPS (TLS 1.2 or higher), with HSTS. Google Cloud encrypts the database, backups, and stored files at rest. Mailbox secrets — Gmail and Outlook tokens, SMTP and IMAP passwords — are additionally encrypted with AES-256-GCM; keys sit in Google Secret Manager, separate from the database.

Privacy commitments we publish

Our Privacy Policy (last updated 3 June 2026) is written to support compliance with GDPR, Singapore’s PDPA, India’s DPDP Act, and California’s CCPA/CPRA.

Collection. Recruiter and admin account details; candidate profiles and résumé files you upload or that candidates submit on public job applications (with consent at submission); optional Gmail send and Google Calendar scopes if you connect them; and server logs for security and operations. We also run cookieless, privacy-friendly analytics on our own infrastructure for public pages — no cookies, IP addresses, or personal identifiers.
Use. Limited to running the ATS: candidates, jobs, clients, interviews; transactional email you initiate; résumé parsing and AI-assisted matching via Google Vertex AI; secure file storage; fraud prevention; and support. We do not sell personal data or repurpose candidate data for marketing, advertising, or model training outside the recruitment workflow.
Sharing. Only listed sub-processors, including Google Cloud, Microsoft if you connect Outlook, Razorpay, Sentry, email delivery you configure or a fallback SMTP, and Google reCAPTCHA. See the Privacy Policy for the full list.
Retention and deletion. Data is kept while the account is active. Deleting a candidate removes the résumé file, parsed text, related activity entries, and related rows. You can delete the whole account as well.
Rights. Access, correction, erasure, portability (JSON export), and the rights listed under PDPA, DPDP, and CCPA/CPRA, depending on jurisdiction. Requests: privacy@sohamrecruit.com or the privacy request form. We aim to respond within 30 days. For candidates in a recruitment company’s tenant, we may coordinate with that agency as controller.
Breach notification. When a personal data breach meets the legal threshold, we notify affected tenants without undue delay and within 72 hours of becoming aware of it.
Cookies. Strictly necessary only — no advertising, analytics, or tracking cookies.

Company admins can export all company data as structured JSON from Settings at any time.

What we do not claim

Honesty is part of the product. Our FAQ and Security page state plainly that SohamRecruit is not SOC 2 certified and does not currently hold ISO 27001. We will update the Security page when that changes.

We also do not describe ourselves as “GDPR certified.” We are not HIPAA covered, and we do not offer India-only data residency. Our public posture is alignment and tooling — consent on applications, export and erasure, tenant isolation, encryption for credentials, published sub-processors, and a privacy contact — not a trust-center badge we have not earned.

If an enterprise RFP requires SOC 2 or ISO 27001 as a hard gate today, that is a real constraint. Many small and mid-sized agencies still need a clear answer to “where is the data, who can see it, and how do we delete it?” That is what the pages above document.

Read the source documents — and try the product

To see export, roles, and candidate deletion in your own workspace, start a 30-day free trial — no card required — on sohamrecruit.com. Plans are on Pricing (Lite, Starter, and Pro per seat; audit log and Data API on Pro). Privacy or security reports: privacy@sohamrecruit.com.