Hone is built for UK recruitment agencies handling regulated candidate data. In short: data is encrypted in transit and at rest, workspace access is role-scoped and audit-logged, candidate data lives in the EU, and we operate under a written Data Processing Agreement with every customer.
Encryption. TLS 1.2+ in transit; AES-256 at rest on managed database and object storage.
Access control. Row-level security scoped to workspace membership; MFA available; least-privilege service credentials; production access limited to on-call engineers.
Auditability. Sensitive actions are recorded in an append-only audit log per workspace.
Data location. Primary data is hosted in the EU (Ireland). International transfers use the UK IDTA or SCCs + UK Addendum where required. Current sub-processors are listed at /legal/sub-processors.
Incident response & disclosure. Report suspected vulnerabilities to security@detecktiv.io. See our security.txt for coordinates.
The complete, contractually-binding set of security measures — encryption, access control, network security, resilience, personnel, incident management and audit — lives in Annex 2 of our Data Processing Agreement.
Read the DPA →