A clear security baseline—without borrowed badges.
CandidatesAssessment handles hiring evidence that agencies and candidates need to trust. This page states what can be supported publicly today and separates it from documentation and certification work still in progress.
Current public baseline
These are the controls and disclosures we can state without extending beyond the available product and legal evidence.
- Legal foundation
- Public Privacy Policy, Terms of Service, Data Processing Addendum, and cookie disclosures.
- Application boundaries
- The current application architecture is designed around authenticated access, private server routes, and company-scoped records.
- Responsible disclosure route
- Security and procurement questions can be sent to contact@candidatesassessment.com.
- Human decision boundary
- Assessment results support hiring review; the platform does not present them as an automatic hiring decision.
Documentation being completed
These items are required before stronger procurement claims can be made. They are listed here as work—not as active certification.
Infrastructure and data flowHosting locations, encryption implementation, backups, recovery, and environment boundaries.Evidence review
Access and auditRole model, least privilege, administrative controls, audit history, and access-review process.Architecture phase
Retention and deletionRecord-level schedules, client configuration, deletion verification, and candidate request workflow.Policy + product
Subprocessors and incident responseNamed register, change process, notification route, severity and communication procedures.Owner review
Independent assurancePenetration testing and a demand-led SOC 2 Type II roadmap before any certification claim.Not yet certified
Review the current documents
These links are the present public source of truth for legal and data-handling terms.
Bring security into the first workflow review.
Tell us which client, data, retention, and procurement requirements need to be considered before a pilot.
Start Assessing
Create an agency account with your work email or Google, then set up the first role.