Security and compliance
Candidate data is personal. We treat it that way.
Résumés, interview notes and self-ID answers are some of the most sensitive records a company keeps. Here is how we protect them, how long we keep them and who can see them.
Controls we run, and test every year.
Slatework completes a SOC 2 Type II examination by an independent CPA firm each year. Customers on any plan can read the latest report under a nondisclosure agreement.
Access control
Role-based permissions per job, so an interviewer sees only the candidates they meet. Single sign-on and automatic deprovisioning on Enterprise.
Encryption
TLS 1.2 or later in transit and AES-256 at rest, including backups and résumé files. Keys rotate yearly.
Audit logging
Every profile view, export, stage change and permission change is logged with who and when, kept for two years and searchable by admins.
Hosting and resilience
Hosted in two US regions with hourly backups, a four-hour recovery objective and a restore test every quarter.
Vendor management
Every subprocessor is reviewed before onboarding and every year after. We give 30 days’ notice before adding one.
People and change
Background-checked employees, yearly security training, peer-reviewed code changes and an annual third-party penetration test.
Keep candidate data only as long as you need it.
Set how long Slatework keeps candidates after their last activity. When the period ends, we anonymize the profile: names, contact details, résumés and notes are removed, and the counts in your reports stay.
Candidates can ask to see or delete their data at any time from the link in every email we send for you.
Our default. Covers most federal record-keeping periods for applicants.
Rejected today
Monday, November 9, 2026Admins get a reminder
Oct 9, 2028, a month before, in case of a legal holdProfile anonymized after 24 months
Thursday, November 9, 2028
Voluntary self-ID, kept apart from hiring decisions.
Employers with federal reporting duties, including many federal contractors, may need applicant demographic data. Slatework collects it on a separate, clearly voluntary step and stores it apart from the candidate profile.
Separate storage and access
Self-ID answers never appear on profiles, scorecards or exports used by interviewers. Only roles you grant reporting access can see summaries.
Summary reports by job and stage
Applicant flow by job group and stage, ready to support EEO-1 and affirmative action planning, with small groups suppressed in on-screen views.
Disposition reasons on every rejection
Required, job-related reasons when a candidate is rejected, so your records explain each decision.
This page is general information about how Slatework works, not legal advice. Your obligations depend on your size, contracts and locations; confirm them with your own counsel.
Subprocessors
The service providers that process customer data for Slatework, by function. The named list is in our security packet.
| Function | Data processed | Location |
|---|---|---|
| Cloud hosting and storage | All customer data | United States (two regions) |
| Transactional email | Names, email addresses, message content | United States |
| Résumé parsing | Résumé files and extracted fields | United States |
| Customer support tooling | Admin names and support conversations | United States |
| Error monitoring | Technical logs, with candidate data removed | United States |