SECURITY

Security

This page is maintained by ReCapacity to answer common security questions about the ReCapacity platform. It describes controls that are in place today. It is not a certification and it is not an independent audit result.

Access levels

ReCapacity has two application access levels: Recruiter and Management. Every authenticated request is evaluated against the signed-in user’s own credentials, and access is granted only to that user’s organization.

Tenant separation

Organization data is separated at the database level. Access rules are enforced by the database itself, so an authenticated request cannot read another organization’s data even if it is constructed by hand.

Data in transit and at rest

Traffic to ReCapacity is served over HTTPS. Sensitive integration credentials are encrypted before storage, and privileged operations are restricted to server-side code that verifies the caller first.

Integrations

Enterprise deployments may connect an ATS, and Outlook where applicable to the selected deployment. Integration scopes are limited to what the capacity measurement requires and are configured with your organization during onboarding.

Auditability

Configuration changes and privileged actions are recorded in an audit trail so organizations can review what changed, when and by whom.

Reporting a concern

To report a suspected vulnerability or ask for details not covered here, contact us through the Enterprise demo form on this website.

Shared responsibility

ReCapacity is responsible for the platform controls described above. Your organization is responsible for managing its own users, the data it connects and the internal handling of ReCapacity outputs.