Trust & security
Our customers' trust and the protection of candidate data are central to Hirify. This page summarizes our security measures, our GDPR compliance, and our responsible approach to artificial intelligence.
Last updated : October 6, 2026
Hosting and data residency
The application servers and the database are hosted in France. Traffic is encrypted in transit. The database is backed up automatically. The location of our main sub-processors is shown in the table below.
- Application servers
- France
- Database
- France
- Encryption
- In transit
- Backups
- Automatic
Platform security
Encryption
Data encrypted in transit. Integration tokens and second-factor secrets are encrypted by the application.
Authentication
Enterprise single sign-on via SAML 2.0, with a second factor available.
Access control
Access partitioned by organization and graded by role, following the principle of least privilege.
Monitoring and logging
Application monitoring and access logging.
Backups and recovery
Automatic database backups and defined recovery objectives.
Data protection and GDPR
Hirify acts as a processor within the meaning of the GDPR, while the recruiting client remains the controller. We apply data minimization and defined retention periods.
Data subjects exercise their rights of access, rectification, and erasure through their usual contact. Our data protection contact is rgpd@hirify.fr.
- Data processing agreement
- The commitments required by Article 28 of the GDPR are set out in our terms (Articles 14 and 16).
- Breach notification
- Notification to the controller within 48 hours.
- Retention
- Periods set by the customer, as controller.
Our sub-processors
| Function | Provider | Location |
|---|---|---|
| Meeting capture | Recall.ai | European Uniondata localized in the EU, entity outside the EU |
| Transcription | Gladia | France |
| AI analysis and text recognition | Mistral | France |
| Database and technical processing | Scaleway | France |
| Hosting | Scalingo | France |
| Semantic search | Voyage and Cohere | United States and Canadatransfer governed by Chapter V of the GDPR |
| Search on the recruiter's LinkedIn account | Unipile | France |
| Telephony | Telnyx | European Uniondata localized in the EU, entity outside the EU |
| Brevo | France | |
| Observability | Monocle | Switzerland |
| Support | Crisp | France |
Processing located outside the Union, or entrusted to an entity established outside the Union, falls under Chapter V of the GDPR. This list shows our main sub-processors; the complete named list, with the transfer mechanism for each, is provided when the contract is signed.
Responsible artificial intelligence
Humans decide
Hirify assists the recruiter, it does not decide in their place. By default, nothing is written to your ATS without an action from the recruiter. An administrator can turn on three automations, off at installation (tags, filling empty fields, publishing the interview summary), and decisions about candidates remain human.
Traceable analyses
Our analyses are anchored to verifiable quotations from the interview, which prevents unfounded claims.
Non-discrimination
Safeguards prevent the system from retaining protected characteristics, in accordance with Article L1132-1 of the French Labour Code and Directive 2000/78/EC.
Your questions
Evaluating Hirify? Write to us with your security and data protection questions.
The detailed compliance dossier is shared under a confidentiality agreement.
The company's legal information for HIRIFY SAS is available in the legal notice. The processing of personal data is described in the privacy policy.