Security & infrastructure
Enterprise-grade infrastructure
We prioritise the security and integrity of your data with enterprise-grade infrastructure, comprehensive security measures, and transparent data management policies designed specifically for recruitment and HR operations.
Banking-grade by background
- Our founder is an ex-VP of Engineering for a leading UK banking business
- Half a decade designing defensible banking systems
- Your recruitment data gets the same level of protection
Infrastructure security compliance
Recruitly leverages Google Cloud Platform (GCP) and MongoDB Cloud as our infrastructure providers, which maintain rigorous security certifications including ISO 27001, SOC 2 Type II, and various other compliance standards. While we benefit from their secure infrastructure, we follow security best practices aligned with these standards in our own operations.
Security infrastructure
Recruitly's infrastructure is built on Google Cloud Platform (GCP), implementing a Zero-Trust architecture for maximum security. Our platform leverages Google's secure-by-design infrastructure, built-in protection and global network to safeguard your information, identities, applications and devices.
Principle of least privilege
Access rights limited to the minimum necessary to perform required functions.
Network segmentation
Critical systems isolated with defined security boundaries.
Multi-factor authentication
Mandatory MFA for all administrative access to systems.
Our infrastructure undergoes regular security assessments, including vulnerability scanning and penetration testing conducted by independent third-party security firms.
Data storage and resilience
Recruitly implements a multi-region, highly redundant storage architecture so your data stays available, protected and compliant with regional data sovereignty requirements. All data is stored exclusively within EU regions.
Primary data centre
Google Belgium (europe-west1) — data is distributed across multiple physical locations for high availability and redundancy.
- N+2 redundancy
- Automated failover
- 99.99% uptime SLA
- Continuous monitoring
Secondary data centre
Google London (europe-west2) — all data is synchronised in real time from Belgium for resilience, and retained there for 30 days.
- RTO under 4 hours
- RPO under 15 minutes
- Automated failover testing performed monthly
This dual-region approach ensures business continuity and robust disaster recovery capabilities with minimal recovery time objectives.
Data protection measures
We employ Mongo Cloud Ops Manager to deploy, monitor and back up our database servers. Recovery processes are regularly tested and can restore services within our defined SLA recovery timeframes.
Backup and recovery
- Continuous incremental backups with 15-minute intervals
- Daily full database snapshots with integrity verification
- Point-in-Time recovery options with 5-minute granularity
- Automated backup verification and validation
- Geo-redundant backup storage across multiple regions
- Rapid restoration capabilities with documented procedures
- Monthly disaster recovery testing and simulation
Security controls and encryption
- All data encrypted at rest using AES-256 encryption
- All transfers secured with TLS 1.3
- Encryption key management with automatic rotation
- Role-based access control throughout
- Regular security audits and penetration testing
- Continuous security monitoring with 24/7 alerts
- DDoS protection and Web Application Firewall
Our security program is regularly audited against industry standards including ISO 27001, SOC 2 Type II and GDPR requirements. Vulnerability management runs automated scanning, risk assessment and remediation tracking across all systems; intrusion detection monitors 24/7 for suspicious activity with automated threat response; and identity management centralises authentication with multi-factor verification for all access.
Data retention
Our retention policy balances the business needs of our customers with data minimisation principles and regulatory requirements, with clear timelines for retention and deletion.
Unlimited
Active accounts
All data retained while the account is active.
30 days
Deactivated accounts
Data retained in a recoverable state.
30 days
Terminated accounts
Held in encrypted backups, then automatically purged after backup rotation.
What termination actually does
Immediately
Logical deletion of all customer data from production systems.
For 30 days
Data remains in our encrypted backups.
Then
As backup rotation occurs, all data is permanently destroyed. Confirmation of deletion is provided on request.
Enterprise exceptions
For customers with specific regulatory requirements we offer customisable retention: extended periods for audit purposes, configurable retention by data category, automated deletion workflows and legal hold capabilities.
GDPR and data privacy
Recruitly is designed with privacy by design principles at its core, and provides the tools your organisation needs to meet its GDPR obligations while keeping full control over candidate and employee data.
Data subject rights
Built-in workflows handle data subject access requests within GDPR timeframes. Every request is logged and tracked.
- Right to access personal data
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
Consent management
Collect, record and manage user consent in line with GDPR requirements, across the whole consent lifecycle.
- Supports GDPR consents for up to 4 years
- Timestamp and version control for all consent changes
- Automated data removal when consent is withdrawn
- Audit trail for compliance purposes
As a data processor
Recruitly provides the tools for you to enforce your own GDPR policies.
Talk to the security team
For detail on our security measures, to discuss specific requirements, or to report a vulnerability through our responsible disclosure programme.