Trust centre
How Recruitment Smart protects candidate and customer data, governs its AI and keeps hiring decisions with people. Everything your security, privacy and procurement teams need is here, or available on request.
Private hosting
Hosted privately on AWS, Microsoft Azure, Google Cloud or Oracle Cloud, with regional deployment for data residency.
Encrypted everywhere
AES-256 at rest and TLS 1.2/1.3 in transit.
People decide
The AI recommends and explains; people make every hiring decision.
Independent assurance
Bias testing and AI assurance from Warden AI.
How the platform is built
Agents run on the six products, the products share one competency framework and a model-agnostic AI layer, and everything is hosted privately on the cloud you choose and connected to the ATS or HRIS you already run.
Security, privacy and AI controls
The controls behind the platform, grouped by area.
AI Model Architecture & Usage Controls
6
| Control | Description |
|---|---|
| Model Architecture | SniperAI leverages a hybrid AI architecture combining proprietary ML models with state-of-the-art LLMs to deliver high-accuracy candidate matching, ranking, and insights. |
| Model Flexibility | Supports multi-model orchestration with the ability to switch or integrate different LLM providers based on client requirements. |
| Vector Search & Matching | Uses vector embeddings to enable semantic search across large candidate datasets, improving relevance and discovery. |
| AI Usage Scope | AI is designed to assist in sourcing, screening, ranking, and insights generation. Final hiring decisions remain fully human-driven. |
| No Automated Decision-Making | SniperAI does not autonomously make hiring decisions; it provides explainable recommendations only. |
| Explainability | AI outputs include scoring logic, matching insights, and reasoning to ensure transparency for recruiters. |
Data Usage & Privacy Controls
6
| Control | Description |
|---|---|
| Customer Data Usage | Customer data is never used to train base AI models unless explicitly agreed under a separate contractual arrangement. |
| Data Types Processed | Includes CV data, professional information, skills, education, work experience, and recruiter inputs. |
| Sensitive Data Handling | Sensitive and protected attributes (e.g., health, political views, biometric data) are excluded from processing and training. |
| PII Protection | Personally identifiable information (PII) is pseudonymised or masked during AI processing workflows. |
| Data Minimisation | Only required fields are processed, supporting compliance with GDPR and data minimisation principles. |
| Data Ownership | All candidate and customer data remains fully owned and controlled by the client. |
Data Storage, Retention & Security
7
| Control | Description |
|---|---|
| Cloud Infrastructure | Hosted on secure cloud platforms such as AWS and Microsoft Azure with regional deployment flexibility. |
| Encryption at Rest | All stored data is protected using AES-256 encryption. |
| Encryption in Transit | Data in transit is secured using TLS 1.2/1.3 protocols. |
| Data Retention Policy | Data is retained based on contractual or regulatory requirements and can be deleted upon client request. |
| Secure Deletion | Data is securely erased or anonymised after retention expiry. |
| Backup & Recovery | Automated encrypted backups with disaster recovery capabilities across multiple availability zones. |
| Data Residency | SniperAI enables region-specific data hosting through AWS and Microsoft Azure, so that customer data can be stored and processed within designated jurisdictions, helping customers meet data sovereignty requirements such as GDPR, PDPA, and other regional regulations. |
Access Control & Identity Management
6
| Control | Description |
|---|---|
| Role-Based Access Control (RBAC) | Access is granted based on least privilege principles aligned with user roles. |
| Single Sign-On (SSO) | Supports SAML 2.0 and OAuth/OpenID Connect for enterprise identity integration. |
| Multi-Factor Authentication (MFA) | Enforced for privileged and administrative access. |
| Access Reviews | Periodic (quarterly/annual) access reviews to validate permissions. |
| User Lifecycle Management | Automated provisioning/deprovisioning through SCIM or identity provider integrations. |
| Privileged Access Segregation | Separate administrative accounts for high-privilege operations. |
AI Governance & Compliance
6
| Control | Description |
|---|---|
| AI Governance Framework | SniperAI follows structured AI governance aligned with ISO 27001, GDPR, NYC Bias, Colorado SB, California FEHA and responsible AI practices. |
| Bias & Fairness Testing | Regular bias detection and fairness testing conducted during model updates. |
| Human Oversight | All AI recommendations are subject to recruiter validation and control. |
| Audit Logging | Comprehensive logging of AI actions, user activity, and system events. |
| Policy Reviews | AI and security policies reviewed periodically for effectiveness and compliance. |
| Regulatory Compliance | Designed to support compliance with GDPR, CCPA, and other global data protection regulations. |
AI Security & Risk Management
6
| Control | Description |
|---|---|
| Prompt Injection Protection | Input validation and monitoring mechanisms to prevent malicious prompts. |
| Data Poisoning Prevention | Controlled data ingestion with validation and integrity checks. |
| Secure Development Lifecycle | Security embedded across design, development, testing, and deployment phases. |
| Vulnerability Management | Regular scanning, patching, and penetration testing. |
| Incident Response Plan | Defined procedures for detection, containment, mitigation, and reporting of security incidents. |
| Continuous Monitoring | Real-time monitoring of AI performance, anomalies, and security events. |
Monitoring, Logging & Auditing
6
| Control | Description |
|---|---|
| Centralised Logging | Logs collected for system activity, AI processing, and access events. |
| Real-Time Monitoring | Continuous monitoring for anomalies, threats, and system health. |
| Audit Trails | Immutable logs for compliance, forensic analysis, and traceability. |
| Performance Monitoring | Metrics include latency, accuracy, and system reliability. |
| Internal Audits | Regular internal audits for compliance and control validation. |
| Third-Party Audits | External audits (e.g., SOC 2 Type II, ISO) conducted where applicable. |
Business Continuity & Resilience
4
| Control | Description |
|---|---|
| Disaster Recovery | Multi-zone deployment with automated failover capabilities. |
| Backup Strategy | Encrypted backups with regular recovery testing. |
| High Availability | Redundant infrastructure ensuring minimal downtime. |
| Business Continuity Plan | Documented procedures for maintaining operations during disruptions. |
Vendor Risk & Subprocessor Governance
6
| Control | Description |
|---|---|
| Vendor Due Diligence | Security, privacy, and compliance assessments before onboarding subprocessors. |
| Contractual Safeguards | Data protection agreements (DPA), confidentiality clauses, and no-training clauses enforced. |
| Subprocessor Transparency | Customers are provided with a list of subprocessors upon request. |
| Periodic Reviews | Annual or periodic reassessment of vendor security posture. |
| Data Processing Restrictions | Subprocessors are restricted to processing data only for defined purposes. |
| Cross-Border Compliance | Data transfer mechanisms are designed to support compliance with GDPR and international data transfer regulations. |
Documentation
Public documents open directly. Others are shared on request with your security or procurement team.
Certification & Standard
- ISO/IEC 27001 (Information Security Management) Request access to ISO/IEC 27001 (Information Security Management)
- SOC 2 Type II Request access to SOC 2 Type II
- GDPR DPA Request access to GDPR DPA
- NCA ECC Report Request access to NCA ECC Report
- AI Bias Report (Warden AI) Open AI Bias Report (Warden AI)
- CCPA (California Consumer Privacy Act) Request access to CCPA (California Consumer Privacy Act)
- CSA STAR CAIQ Open CSA STAR CAIQ
- VAPT (Latest) Request access to VAPT (Latest)
- PDPL Request access to PDPL
- PDPA Request access to PDPA
Partnership
- SAP SF Request access to SAP SF
- Workday Request access to Workday
- Organisational Policies Request access to Organisational Policies
- Insurance Request access to Insurance
Subprocessors
Third parties that process data on our behalf. Customers can request the current list and its terms at any time.
| Subprocessor | Purpose | Location |
|---|---|---|
 Azure | AI Model Provider | — |
 Microsoft | Cloud Hosting | — |
 AWS | Cloud Hosting | — |
AI ethics statement
Recruitment Smart builds AI to make hiring faster and fairer, never to take hiring decisions away from people.
- People decide. Our AI sources, screens, ranks and summarises. It does not make hiring decisions; every recommendation is reviewed by a recruiter or hiring manager.
- Every score is explained. Match scores come with the reasoning behind them, built on RST's competency framework, so decisions can be checked and defended.
- Fairness is tested. We run bias and fairness testing when models change, and Warden AI independently assures our candidate screening.
- Sensitive data stays out. Protected attributes such as health, political views and biometric data are excluded from processing and training.
- Your data is yours. Customer data is not used to train base models unless that is agreed in a separate contract.
- Governed to recognised standards. Our AI governance aligns with ISO 27001, ISO 42001, GDPR, New York City's bias-audit law, Colorado's AI legislation and California FEHA, alongside responsible-AI practice.
Independent AI assurance by Warden AI
Warden AI independently tests Recruitment Smart's AI candidate screening for bias, and its report is available on Warden AI's trust page.
Security contact
For security questionnaires, documentation requests or to report a vulnerability, contact our security team.
Contact the security teamSecurity and AI questions
Is customer data used to train AI models?
No. Customer data is never used to train base AI models unless that is explicitly agreed in a separate contract. Protected attributes such as health, political views and biometric data are excluded from processing and training.
Does the AI make hiring decisions?
No. The AI helps with sourcing, screening, ranking and insights, and explains each recommendation. Final hiring decisions are always made by people, and every recommendation is subject to recruiter review.
Where is candidate data hosted?
Wherever you prefer. Recruitment Smart is cloud-agnostic and is hosted privately on AWS, Microsoft Azure, Google Cloud or Oracle Cloud, with regional deployment for data residency. The same controls apply everywhere: ISO 27001, SOC 2 Type II, support for GDPR and CCPA, and independent AI assurance from Warden AI.
How do we get your security documentation?
Public documents, including the CSA STAR CAIQ and the Warden AI bias report, are linked in the documentation section. Others, such as SOC 2 Type II and ISO/IEC 27001 evidence, are shared on request with your security or procurement team.