SECURITY & PRIVACY

    Security and privacy at Hyre

    Hyre processes the conversations of recruiters with candidates and clients. That needs care. This page says what we do, where your data is, and what we do not have (yet).

    Book a demo

    Where your data is

    • The application runs in a data centre in the Netherlands.
    • The database is in Frankfurt, Germany.
    • We keep meeting recordings for 30 days at our recording provider in Frankfurt. Transcription runs in the EU. The transcript and the summary are then stored in our database.
    • LinkedIn and WhatsApp messages go through a vendor in France.
    • The connection to your ATS goes through an integration partner in the EU, or directly to your ATS.
    • A small part goes outside the EU: email and calendar sync, the AI gateway, server logs (ids and counts only, no message content), billing and phone calls. For each vendor, the role, the country and the legal basis (EU-US Data Privacy Framework or Standard Contractual Clauses) are on hyre.io/subverwerkers.
    • A module you do not use sends nothing to the vendor behind it.

    Encryption

    • Every connection uses TLS 1.2 or higher.
    • Stored data is encrypted with AES-256.
    • The access keys of your connected accounts (email, LinkedIn, ATS) get an extra encryption per field (AES-256-GCM), with a separate key per type of data.

    Sign-in and access

    • You sign in with Google or Microsoft. Hyre stores no passwords. Two-factor authentication comes from your own Google or Microsoft tenant.
    • Each customer sees only its own data. Every database query is limited to one organization, and every table has row-level security.
    • Inside your organization, a user sees only their own conversations by default. An admin can give colleagues access.
    • A small number of Hyre staff can look in for support. Each time that happens, we record who, when and why. Your admins see it in Settings.
    • Our staff use two-factor authentication on every system that holds customer data.

    AI

    • Every AI request goes through one AI gateway to a fixed list of providers. That list is on hyre.io/subverwerkers.
    • Every request requires zero data retention: the provider does not store your data and does not train on it.
    • Hyre does not train AI models on your data.
    • AI makes suggestions: a summary, a draft, a match. The recruiter decides. No feature rejects a candidate or moves a candidate in your ATS on its own.
    • Hyre does not recognise emotions and does not infer personality.

    Meetings

    • The notetaker joins with a visible name and logo, and posts a message in the chat: the meeting is recorded and summarised with AI, and how to remove it.
    • You can switch the notetaker off for any meeting.

    Product analytics

    • We measure how Hyre is used with an analytics tool in the EU. Session replays mask all text and images, so no messages, names or photos.

    Your rights and your data

    • What you delete in Gmail, Outlook, LinkedIn or WhatsApp, Hyre deletes too.
    • Your admin can erase one person completely, including email, LinkedIn, WhatsApp, meetings and calls. You get a receipt of what was removed.
    • You can export the data of one person or of your whole organization, as JSON or CSV.
    • When your contract ends, we export your data and delete it within 10 working days, with a written confirmation.
    • Backups are made daily, encrypted, and overwritten after 7 days.

    Agreements

    • Hyre is the processor, you are the controller. The data processing agreement is part of every contract.
    • We announce a new subprocessor at least 30 days in advance.

    Data breaches

    • We have a fixed procedure. If a breach affects your data, you hear from us within 48 hours.
    • Found a security problem? Email [email protected].

    What we do not have

    • We have no ISO 27001 or SOC 2 certification.
    • We test our security ourselves, with code audits and tests of our staging environment. We have not had an independent penetration test yet.
    • The LinkedIn connection uses the recruiter's own session, through an integration partner, not LinkedIn's official API. The module is on only when you connect it.

    Documents

    On request we send: the data processing agreement, the subprocessor list, our technical and organisational measures, input for your DPIA, and our position under the AI Act. Email [email protected].

    Book a demo

    Ready to recruit smarter with AI?

    Join 50+ recruitment teams using Hyre to save time, make better placements and consolidate their scattered tools into one AI layer on top of their ATS.

    Book a demo

    Guided 3-month pilot · Your data stays yours · GDPR-aware