Security Overview
Effective October 1, 2026.
Our clients trust the Visibility HR platform with the information of the people they hire and develop. This page describes how we protect it. A more detailed description of our controls is available to clients on request, and our Privacy Statement explains how the information is used.
The platform is hosted on Amazon Web Services in the United States. Production runs in an east-coast region; backups are kept for a rolling seven days in a separate west-coast region. Each client has its own database. Client data is not stored on laptops or in offices.
All traffic between browsers, integrations, and the platform is encrypted in transit using TLS. Passwords are stored only as salted hashes. The platform sits behind multiple firewalls with intrusion detection, antivirus protection, and 24-hour network monitoring with a rapid-response team. Access within the platform is role-based, so a client controls which of its users can see which records, and activity is logged.
Access to production systems is restricted to a small number of named Visibility HR staff who need it to run and support the platform. Server access requires multi-factor authentication, and reaching client data requires a further authentication step. Staff are trained on data protection when they join and annually. We do not use client data for anything other than providing and supporting the platform, and we never use it to train artificial-intelligence models.
A short list of service providers helps us run the platform: AWS for hosting, Amazon SES for email delivery, Affinda for resume parsing, Hireflix for one-way video interviews when a client turns them on, Indeed for job distribution when a client turns it on, and integrated screening partners such as Verified First that a client contracts with directly. Each is bound by contract to protect client data and use it only to provide its service. The current list, with processing locations, is in Section 2.5 of our Privacy Statement, and clients receive 30 days' notice before any addition.
We maintain a documented incident response plan, reviewed and updated on an ongoing basis. Any staff member who suspects a data incident must alert our CEO and COO within 24 hours. Our response team assesses the incident within 48 hours of being convened, contains it, and documents the cause and the fix. If client data has been accessed, disclosed, or lost without authorization, we notify the affected client without undue delay and in any event within 48 hours of confirming the incident, with what we know, what we have done, and what we recommend, and we support the client with the information it needs for any notices it owes to its people or to regulators.
A client may request a full export of its data within ten days after its subscription ends, delivered in a standard format. We delete the client's database from production within 30 days after the subscription ends and from backups within 180 days after that, unless the law requires us to keep something longer.
We run vulnerability scanning on the production environment using AWS security tooling and an independent security consulting firm, and address findings by severity. An independent penetration test is performed annually. We review this page and the controls behind it at least annually and whenever the platform changes in a way that affects security.
Clients and prospective clients can request our detailed security description, complete a security questionnaire with us, or ask about a specific control by writing to privacy@visibilityhr.com or contacting their account team.
