How candidate data is handled

Access control

Every table holding candidate or organisation data has row-level security enforced in the database itself, with policies scoping rows to the organisation that owns them. Access control is not applied only in application code, so a bug in a query cannot return another organisation’s candidates.

Within an organisation, team members hold roles that determine what they can see and change. Candidate records, notes and documents are scoped to the organisation that created them and are never pooled across customers.

In transit and at rest

All traffic is served over HTTPS with HTTP Strict Transport Security preloaded, so browsers refuse to connect over plain HTTP. Data is encrypted at rest by the managed database and object storage.

The application sets a restrictive set of browser security headers, including a same-origin frame policy, MIME-type sniffing protection, a strict referrer policy, and a permissions policy that denies geolocation and limits camera and microphone access to the site’s own interview features.

Automated decisions

Candidate scoring is decision support. The platform ranks, summarises and explains; it does not reject candidates on its own, and the reasoning behind a ranking is visible to the hiring team rather than hidden behind a number.

This is deliberate, and it is also the simplest way to stay clear of a specific Saudi requirement. The Personal Data Protection Law has no blanket ban on solely automated decisions and no statutory right to human review — that rule is GDPR Article 22 and is widely misattributed to the PDPL. What the implementing regulations require is that consent be explicit where a decision is made solely by automated processing, that candidates are told such decisions are being made, and that a written data protection impact assessment is completed. Keeping a person accountable for the outcome means none of those obligations is triggered in the first place.

Sub-processors and data location

The platform runs on managed cloud infrastructure and uses third-party providers for database hosting, file storage, email delivery, video interviews and AI model inference. Which providers, and in which regions candidate data is stored and processed, are questions you should ask directly before signing — and you should expect a specific answer with region names in it, not a general assurance.

If you have residency requirements under PDPL or an internal policy, raise them during evaluation rather than after. Ask us in writing and we will answer in writing.

Candidate rights

Candidates whose data is in the platform can request access to it, correction, or deletion. Because the employer is the data controller and Rezome is the processor, those requests normally go to the employer, and the platform supports the employer in acting on them. If a candidate contacts us directly we will route the request to the relevant employer.