Security
Candidate data, handled like it matters
Recruiting means holding other people's CVs, voices and phone numbers. This is how HrThroo protects them.
Workspaces never see each other
Every candidate, CV, recording, transcript, mailbox, phone number and shortlist belongs to one workspace, and every request is checked against it.
Credentials encrypted at rest
Mailbox passwords, OAuth tokens and telephony credentials you connect are encrypted with AES-256-GCM under a key held outside the database, and never sent to a browser.
Encrypted in transit
Every connection to HrThroo, and from HrThroo to its providers, uses TLS.
Access by role
Members see and do what their role allows. Decisions about candidates are recorded with who made them and when, and sensitive changes go to an audit log.
Client links that end
Shortlist links expire, can be revoked at any moment, show only the shortlist they were made for, and log every open.
Verified webhooks
Messages from payment, calling and email providers are checked for a valid signature before HrThroo acts on them.
Data in India
The database is hosted in Mumbai. Providers that process data elsewhere are listed on the Subprocessors page.
No training on candidate data
CVs, recordings and transcripts are used only for the hiring they were collected for. They are never used to train AI models.
Found a vulnerability?
Email hello@hrthroo.com with the details and how to reproduce it. We'll reply, keep you posted while we fix it, and credit you if you'd like. Please don't access data that isn't yours or disrupt the service while testing.