Enterprise-grade protection
for your recruitment data

In Transit

• All connections secured with TLS 1.2 and TLS 1.3. Legacy protocols (SSL 3.0, TLS 1.0/1.1) are permanently disabled.
• HTTPS enforced across all endpoints. HTTP Strict Transport Security (HSTS) headers prevent protocol downgrade attacks.
• Certificates issued with automated renewal and short certificate lifetimes.

At Rest

• All stored data — candidate records, CVs, attachments, database dumps — encrypted using AES-256.
• Sensitive fields receive additional encryption at the database layer, in addition to full-disk encryption on underlying storage volumes.
• File uploads (CVs, documents) validated, sanitised, and stored on encrypted volumes with strict access controls.

Key Management

• Encryption keys are managed separately from the data they protect, with restricted access and documented rotation policies.
• Application-level secrets (API credentials, database keys, service tokens) are stored in environment-specific configuration with restricted permissions. Secrets are never committed to version control or exposed in logs.

Role-Based Access Control (RBAC)

Authentication

• Multi-Factor Authentication (MFA): MFA is supported to add a second layer of protection beyond passwords.
• Current SSO: Federated login available today via Google OAuth and LinkedIn OAuth.
• Credential security: Passwords hashed using an industry-standard adaptive algorithm. Plaintext passwords are never stored or logged.
• Session management: Secure, HTTP-only cookies with SameSite protections. Sessions expire on inactivity. Server-side invalidation on logout.

• Data Processing Agreement (DPA): A DPA is available on request to support your compliance and procurement processes. It includes detailed Technical and Organisational Measures (Annex B) and a complete sub-processor list (Annex C).
• Right to erasure: Candidates and customers can exercise their right to be forgotten. Data is permanently deleted upon validated request in line with GDPR Article 17, within 30 days.
• Data minimisation: We collect and retain only the data necessary to deliver the service. Defined data retention policies apply automated cleanup of records beyond their retention window.
• Configurable retention periods: You can align Treegarden's retention settings with your own internal data governance and regulatory requirements.
• Data export: Customers may request a full machine-readable export of their data at any time during their subscription or post-termination retention period.
• DPIAs: Data Protection Impact Assessments are conducted for high-risk processing activities. Records of processing activities are maintained per GDPR Article 30.
• International transfers: Where data is processed by US-based sub-processors, EU Standard Contractual Clauses with the UK Approved Addendum apply. Full transfer mechanisms are documented in the DPA.

• 72-hour breach notification: In the event of a personal data breach, Treegarden will notify affected customers without undue delay and within 72 hours, in accordance with GDPR Article 33.
• Supervisory authority reporting: Where required, breaches are reported to the Information Commissioner's Office (ICO) within the 72-hour window.
• Root cause analysis: Every security incident is followed by a root cause analysis and remediation plan to prevent recurrence.
• Post-incident review: Lessons learned are documented and incorporated into security controls, training materials, and operational procedures.

Severity Levels

Dependency Scanning

• Server-side and client-side dependencies are scanned regularly for known vulnerabilities.
• We track upstream security advisories for our framework and third-party libraries, applying security patches promptly.
• Critical and high-severity vulnerabilities are addressed within the current development cycle. Emergency patches for actively exploited vulnerabilities are applied within 24 hours.

Application Security

• Code review: All changes affecting authentication, authorisation, data access, or file handling undergo security-focused peer review.
• Automated scanning: Security scanning integrated into the development pipeline to catch known issues before production.
• Input validation: Parameterised queries throughout the data-access layer. All user input validated server-side. Strict type and format checks on every endpoint.
• File upload controls: Uploaded files validated against an allowlist of permitted types. Archive formats that may conceal malicious payloads are rejected. Files stored outside the web-accessible directory.
• Hardening: Path traversal protection, strict file-type validation, and command execution timeout controls on all processing operations.

Responsible Disclosure

• Daily automated backups of all production databases and customer data, performed on a scheduled cadence with no manual intervention required.
• 30-day retention of backups, enabling point-in-time recovery within the full retention window.
• Backups are stored on geo-redundant EU infrastructure, isolated from the primary production environment, and encrypted before transfer.
• Recovery testing: Backup restoration procedures are periodically validated to confirm data recoverability and measure recovery time.
• Redundancy: Critical components are designed with redundancy to minimise single points of failure. Uptime targets are published in the Service Level Policy.