Security at VScout

Your recruiting data is sensitive. We treat it that way - encryption, database-enforced tenant isolation, AI governance, and GDPR compliance. Below is what we run today, and what we have not done yet.

GDPR Ready
AES-256 Encrypted
AI Audit Trail
SOC 2 Type II Infrastructure

Encryption & Data Protection

  • All data encrypted at rest with AES-256 on Supabase managed Postgres
  • TLS 1.3 for data in transit between your browser and our servers
  • Resumes and candidate documents held in access-controlled storage buckets
  • Automated daily backups, encrypted at rest, managed by Supabase Cloud
  • Secrets held in the platform secret store - never in source control

Authentication & Access Control

  • Row-Level Security isolates every organization's data in the database itself, not in application code - all 171 tenant tables carry an explicit policy, verified on every build
  • SAML and OIDC single sign-on, SCIM directory sync, and IP allowlisting
  • Multi-factor authentication (TOTP) with recovery codes
  • Role-based access control - owner, admin, recruiter, hiring manager, interviewer, viewer
  • Sessions held in secure, httpOnly cookies
  • Rate limiting on authentication endpoints

AI Governance & Transparency

  • Every AI agent action logged with its reasoning, for human review
  • Candidate data is not used to train third-party AI models
  • Human-in-the-loop by design - agents recommend, people decide
  • Bias reporting on screening outcomes
  • Organization-level controls over what agents may do without approval

Infrastructure

  • Hosted on Vercel and Supabase Cloud, both SOC 2 Type II certified
  • Sub-processor list available on request and in our DPA
  • Application errors and security events monitored with alerting
  • Automated daily integrity checks re-verify tenant isolation and access rules against live data
  • Regular penetration testing and vulnerability assessments
  • No sensitive data cached at the CDN edge

GDPR & Privacy

  • Right to erasure executed across every table linked to a candidate, in a single transaction - not a one-row anonymisation
  • Data processing agreement available on request
  • Export your data at any time in standard formats
  • Configurable retention, with advance notice to your admins before anything is deleted
  • Personal data stripped from logs and error reports before they leave our systems
  • Consent capture for candidate data collection

Incident Response

  • Breach notification within 72 hours, per GDPR Article 33
  • Documented response procedure covering triage, containment, and customer notification
  • Root cause analysis after every security event, with a regression guard added
  • Responsible disclosure welcome at security@vscout.co - see /.well-known/security.txt

Where we are today

We would rather you read this here than discover it in a vendor review.

In place

  • GDPR compliance, including Article 17 erasure and a DPA
  • SOC 2 Type II certified infrastructure providers (Vercel, Supabase)
  • SSO, SCIM, MFA, IP allowlisting, and role-based access
  • Database-enforced tenant isolation, continuously verified
  • Penetration testing and vulnerability assessments

Not yet

  • Our own SOC 2 Type II report - we run to the controls, but we have not completed an audit
  • ISO 27001 - not currently on our roadmap
  • EU or UK data residency
  • A contractual uptime SLA

Have security questions?

We are happy to answer detailed security questions, provide our data processing agreement, or discuss custom security requirements for Enterprise plans.

Start freeContact security team
Security | VScout