How CogniHR protects your hiring data
CogniHR authenticates through Keycloak using OpenID Connect, enforces role-based access on the server for every protected endpoint, serves all traffic over TLS, and issues single-use expiring links for every candidate-facing step so candidates never hold an account.
Controls running in the product now
Everything listed here is enforced in the running system, not planned.
OpenID Connect authentication
Authentication runs on Keycloak with short-lived access tokens and refresh, supporting password and Google sign-in.
Server-enforced role checks
Every protected endpoint validates the caller's roles on the server. Access control is not implemented by hiding buttons in the interface.
Encrypted transport
Traffic is served over TLS, and datastore connections use TLS-authenticated links rather than open ports.
Scoped candidate links
Assessment invitations are single-use tokens with an expiry. Candidates never receive an account, and a spent link cannot be reused.
How your data is handled
Who controls it, where it goes, and what happens when you leave.
You control the record
You are the controller of the candidate and employee data you upload; we process it on your instructions and for no other purpose. We do not sell it, and we do not use your candidate data to train models.
Role-based access, enforced server-side
Recruiter, hiring manager and HR administrator roles are granted and revoked by an administrator, and every protected endpoint checks them on the server rather than relying on a hidden button.
Candidate links are credentials, and are treated as such
Assessment, survey, offer and onboarding links are single-use and carry an expiry. A spent link cannot be reopened, which is also what prevents an assessment being retaken. Those routes are excluded from search engine crawling.
Your data leaves when you do
Applicants, sourced candidates and onboarding records export to CSV at any time. On termination you keep export access, and records are then deleted on the schedule set out in the privacy policy.
Documented subprocessors
Every third party that touches personal data is named in the privacy policy, with what it does and where it processes.
Security questions
How is candidate data protected in transit and at rest?
Traffic is served over TLS, and datastore connections use TLS-authenticated links rather than open ports. Candidate-facing links are single-use and carry an expiry, so a spent assessment or offer link cannot be reopened.
How is authentication handled?
Authentication runs on Keycloak with OpenID Connect, supporting password and Google sign-in with short-lived access tokens and refresh. Authorisation is role-based and enforced on the server for every protected endpoint, not only hidden in the interface.
Security question about your own deployment?
Send it over and you will get a direct answer from the team that built it.