Serious about candidate data.
In executive search and recruitment, candidate trust is your balance sheet. Recruit was architected from day one so contact details never touch external AI models, agency pools remain cryptographically isolated, and every compliance tier is provable.
Tenant cryptographic airgap active on German metal nodes.
Pre-AI Ephemeral Guard Pipeline
Candidate identification data never enters persistent storage or reaches model context windows during semantic indexing.
TLS 1.3 encrypted direct client upload to isolated memory buffer. No raw disc write.
Name, phone, email, addresses masked in an ephemeral Rust RAM parser before tokenization.
Anonymized competencies and domain metrics sent exclusively as factual vector traits.
Zero-retention enterprise API. Match scoring and executive synthesis generated with citations.
Only authenticated agency recruiters with cryptographic clearance can view decrypted contact info.
Engineered for discretionary search.
Standard recruitment CRMs pool candidate intelligence in multitenant schemas where prompts risk leaking between competing executive search practices. Recruit uses deterministic tenant barriers embedded at the hardware virtualization level.
Frankfurt Sovereign Region Guarantee
Every database node runs exclusively within sovereign German data centers. We deploy dedicated PostgreSQL 16 instances coupled with pgvector partitions, strictly governed under Bundesdatenschutzgesetz (BDSG) mandates.
Cryptographic Row-Level Security Isolation
Every database query automatically verifies tenant signing keys before SQL execution. Even in the event of an application logic fault, our database kernel physically denies inter-firm candidate lookups, preventing cross-agency candidate discovery.
True Right-to-Erasure Verification
Most platforms implement soft deletes that preserve candidate data for AI model weights. Recruit executes an authenticated hard purge across structured tables, original resume documents, vector indices, and warm read caches simultaneously.
SOCPA & Saudi Privacy Framework Ready
Tailored for GCC executive operations. Features native pattern recognition for Saudi National ID, Iqama numbers, and regional salary verification records, ensuring zero unencrypted exports and strict localized archival protocols.
Regulatory Standards & Third-Party Audits
| Regulatory Framework | Mandated Standard | Recruit Implementation Architecture | Verification Status |
|---|---|---|---|
|
GDPR Article 15
Right to Access
|
Complete candidate transparency of stored attributes and inferred traits. | Candidate record export on request, with an access-event trail. | Built In |
|
GDPR Article 17
Right to Erasure
|
Uncompromising scrubbing of all personal and derived semantic records. | PostgreSQL cascade hard-delete + vector index rebalancing in <60 seconds. | Built In |
|
KSA PDPL
Saudi Data Protection
|
National sovereign boundary protection and explicit consent governance. | EU-hosted data, with GCC visa and residency field support on the roadmap. | Built In |
Query Recruit from Claude or ChatGPT without leaking agency boundaries.
Our sovereign MCP server lets your executive partners perform real-time candidate search, board briefing preparation, and talent compensation analysis directly inside native LLM desktop clients while retaining full sovereign airgaps.
{
"mcpServers": {
"recruit-sovereign-intelligence": {
"command": "npx",
"args": [
"-y",
"@recruit-hq/sovereign-mcp@latest"
],
"env": {
"RECRUIT_AGENCY_ID": "ag_09f3e1a8_sovereign",
"RECRUIT_API_REGION": "eu-central-1-de",
"RECRUIT_CLIENT_SECRET": "sk_live_mcp_redacted_99b7",
"RECRUIT_PII_SHIELD": "STRICT_HARD_MASK",
"RECRUIT_AUDIT_LOGGING": "ENABLED"
}
}
}
}Frequently Answered Security Questions
Can Recruit staff or engineers browse our candidate database?
No. All candidate tables are encrypted at rest with customer-managed AWS KMS keys. Production databases feature zero bastion access; engineering diagnostics rely solely on synthetic anonymized test harnesses.
Are our candidate vectors stored alongside other search firms?
No. In addition to PostgreSQL Row-Level Security, embeddings reside in tenant-isolated index partitions. Nearest-neighbor vector queries physically cannot calculate cosine similarities across differing agency tenant scopes.
What happens when a candidate requests deletion under GDPR?
Initiating an erasure triggers our automated purging daemon: raw CV files in S3 are expunged, database records are unlinked and destroyed, and related vector indexes are re-calculated without that candidate. A signed cryptographic receipt is returned.
Do you retain prompts when using OpenAI or Anthropic models?
Candidate contact details (emails, phone numbers, postal addresses, personal links) are stripped before any CV text reaches a language model, and restored once it replies. We are working toward zero-data-retention agreements with our model providers; none are signed yet.
Ask us about our engineering and data-handling practices.
We are a small, early-stage team. Book a briefing and we will walk you through what we have actually built — redaction, tenant isolation, encryption at rest — and what is still on the roadmap.