Security at SohamRecruit

Where your data lives

• SohamRecruit runs on Google Cloud in the us-central1 region (Iowa, USA): the application on Cloud Run, the database on Cloud SQL for PostgreSQL, and uploaded files such as CVs on Cloud Storage.
• Data is stored in the United States. If you need it stored in a specific country, contact us before you sign up.

Encryption

• All traffic to sohamrecruit.com uses HTTPS, and browsers are told to always use HTTPS (HSTS).
• Google Cloud encrypts the database, backups and stored files at rest.
• Mailbox connection secrets (Gmail and Outlook tokens, SMTP and IMAP passwords) are additionally encrypted with AES-256-GCM before they are stored. The keys are held in Google Secret Manager, separate from the database.

Keeping each agency’s data separate

• Every agency is a separate tenant. The database enforces this with PostgreSQL row-level security, so a query can only see the rows of the agency it runs for.
• Inside an agency, roles decide what people can do: company admin, recruiter, business development, and client-portal users who only see what you share with them.

Sign-in and sessions

• Passwords are stored only as bcrypt hashes; we cannot see them.
• Sessions use secure, HTTP-only cookies that expire after 8 hours.
• After 5 wrong passwords in 10 minutes an account is locked for 15 minutes, and sign-up, sign-in and password reset are protected by Google reCAPTCHA and rate limits.
• New accounts must verify their email address before they can send email, invite people or manage billing.

Backups and recovery

• The database is backed up automatically every day, and point-in-time recovery is switched on.

Monitoring and audit trail

• Server errors are monitored so we can act on problems quickly.
• Changes to candidate records are kept in an activity log, and administrative actions are recorded in an audit log.

Your control over your data

• Company admins can export their data at any time and delete candidates or the whole account.
• Candidates can make access and deletion requests through our privacy request form.

Certifications

We do not currently hold SOC 2 or ISO 27001 certification. We will say so here when that changes.

Report a security issue

If you think you have found a vulnerability, email privacy@sohamrecruit.com with “Security report” in the subject. Please give us time to fix it before sharing it publicly, and do not access other people’s data while testing.

See also our Data privacy & DPDP Act page, the privacy policy and system status.