Security & Compliance

Your candidate data is sensitive. We treat it that way. Here's how Vettara Search protects your data at every layer.

🔒

Encryption

All data is encrypted in transit (TLS 1.2+) and at rest. Database connections require SSL. API keys are hashed before storage.

🏢

Tenant Isolation

Every organisation's data is isolated by the application and data model. Production storage and access controls are designed to prevent cross-workspace data access.

🛡

Access Control

Role-based access control (RBAC) with separate admin and user permissions. Session-based authentication is active in production, with optional social sign-in only when configured.

🔗

ChatGPT Connector

ChatGPT access uses Vettara OAuth and user-scoped permissions. A public connector listing does not grant public access to Vettara projects, candidates, or exports.

📝

Audit Logging

Significant events such as sign-ins, search activity, exports, and administrative actions are recorded for operational review and incident response.

🌍

GDPR Compliant

Data export and deletion workflows are supported. Data processing controls and subprocessor documentation are maintained for production customers.

⚠

Error Monitoring

Real-time error tracking via Sentry with source maps. Proactive monitoring ensures issues are caught and resolved before they affect your work.

Infrastructure

DatabaseManaged PostgreSQL production database

Frontend HostingVettara production web service with bundled frontend assets

AuthenticationSession-based sign-in, Google or Microsoft sign-in where enabled, and OAuth for ChatGPT connector access

AnalyticsOptional and deployment-specific

Rate LimitingWeb, authenticated, search-run, OAuth, MCP tool, token, and CSV export throttles

BackupsProduction backup and recovery controls; customer-specific details are available on request

AI & Data Handling

Data sent to configured AI providers is limited to the feature the user requested and handled under the applicable provider and data-processing terms. Vettara does not use customer candidate data to train public foundation models.
AI-generated candidate profiles are derived from public or customer-provided professional information. We do not collect credentials for private databases or private social media accounts.
Your search briefs, candidate evaluations, and internal notes are never shared across organisations or used as training data.
ChatGPT connector calls return bounded project, status, candidate preview, and CSV export data only for the signed-in Vettara user and only through Vettara OAuth.
Off-limits and conflict-of-interest rules are enforced at the platform level, preventing candidates from being surfaced in conflicting searches.

Data Processing Agreement

We offer a Data Processing Agreement (DPA) for all customers who require one. Our DPA covers GDPR Article 28 requirements including sub-processor management, data subject rights, breach notification, and audit rights.

View our DPA · View Subprocessors

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly to support@vettarasearch.com. We take all reports seriously and will respond within 48 hours. Review the Responsible Disclosure policy before testing.

Questions about security?

Our team is happy to discuss your security requirements in detail.