Multi-Tenant Row-Level Security
100% of ProHireHQ database tables enforce PostgreSQL Row-Level Security (RLS) partitioned by organization ID. No tenant can ever query, read, or write another organization's candidates or data.
Encryption in Transit & at Rest
All HTTP traffic is secured via TLS 1.3 with strict HSTS preloading. Stored resumes, candidate records, and database snapshots are encrypted at rest using AES-256 standards.
SOC 2 Type II Certified Cloud
Our core application runs exclusively on SOC 2 Type II and ISO 27001 certified cloud infrastructure: Vercel for edge compute, Supabase for managed PostgreSQL, and Inngest for background orchestration.
Cryptographic Key Management
Organization API keys are hashed with SHA-256 before storage. Plaintext keys are shown once upon generation and never stored in the database, preventing token extraction.
Continuous Pipeline Verification
Every pull request undergoes automated secret scanning via Gitleaks, static security analysis, unit testing, and typecheck verification prior to production deployment. Direct commits to production are blocked.
Audit Logging & Traceability
Administrative actions, permission changes, team role modifications, and authentication events are written to append-only audit logs with actor timestamps and client IP addresses.
Certified Sub-Processors
ProHireHQ partners with top-tier cloud infrastructure providers that maintain independent, audited compliance reports.
| Provider | Service Role | Data Scope | Compliance Attestations |
|---|---|---|---|
| Vercel | Application hosting and edge compute | Web traffic and ephemeral runtime requests | SOC 2 Type II / ISO 27001 |
| Supabase | Managed PostgreSQL and file storage | Candidate profiles, job data, resumes | SOC 2 Type II / HIPAA Eligible |
| Inngest | Durable workflow orchestration | Background event execution payloads | SOC 2 Type II |
| Cloudflare | Edge security, DNS, bot mitigation | Network routing, IP reputation | SOC 2 Type II / ISO 27001 |
| Stripe | Subscription billing and invoices | Payment tokens and billing contact records | PCI-DSS Level 1 / SOC 2 |
Vulnerability Disclosure & Security Contact
ProHireHQ welcomes responsible security reports from researchers and customers. We operate in accordance with RFC 9116 security standard directives. If you believe you have discovered a vulnerability, please contact our security team directly:
Email: security@prohirehq.com
Standard Security Manifest: /.well-known/security.txt
Response SLA: We review all security inquiries within 24 hours.
Ready to see ProHireHQ in action?
Schedule an operational walkthrough to review our platform, compliance posture, and hiring workflow.
Book a Demo