Last updated 26 May 2026. This page describes how Hone protects the candidate, client, and recruiter data that runs through the platform. Questions, audits, or DPIA support requests: security@hone.co.uk.
All customer data — candidate records, CVs, shortlists, deals, audit logs — is hosted in the EU (Ireland, AWS eu-west-1) on managed cloud infrastructure, and processed in line with UK GDPR and the Data Protection Act 2018. File uploads (CVs, certificates, branding) are stored in the same region. Some of our sub-processors — for AI inference, error monitoring, product analytics, email delivery, and web-content fetching — are located in the United States. Where personal data is transferred to them, we rely on the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, together with appropriate supplementary measures, as required by UK GDPR. A current data-flow diagram is available on request for DPIA purposes.
Hone is a multi-tenant platform. Every customer row carries a workspace_id and is protected by Postgres row-level security (RLS) policies that scope reads and writes to workspace members only. RLS is enforced at the database layer, not the application layer — even a compromised application server cannot read another workspace's data without explicitly bypassing the database. Public surfaces (marketing profiles, candidate self-service portals) use short, opaque tokens with their own RLS policies and per-request audit logging.
Hone uses role-based access control inside each workspace, with three roles — Owner, Admin, and Member. Owners can manage billing and transfer ownership. Admins can manage members and configure integrations. Members can work with candidates and deals but cannot change workspace-wide settings. Every privileged action is checked server-side via middleware and re-checked by RLS at the database.
Two-factor authentication (TOTP authenticator apps) is available today from Settings → Security. Workspace Admins can also reset a member's factor from Settings → Team. Hone additionally supports Google single-sign-on (which inherits any 2FA the user has configured on their Google account) and email/password login with bcrypt-hashed passwords.
Every meaningful operation on candidates, deals, shortlists, invites, public profiles, and admin surfaces is written to a dedicated audit_events table, with the actor, target, type, and a metadata payload. Anonymous public-surface hits (marketing profile views, candidate-portal loads, application email verifications) are also logged, with hashed IP and user-agent so abuse is visible without storing raw identifiers. Workspace Owners and Admins can export the full audit history for their workspace at any time.
Hone uses a small set of well-known sub-processors for hosting, email delivery, and AI inference. The current list, including the data category each receives, is maintained at /legal/sub-processors. We notify workspace Owners of material additions before they take effect.
We are precise about which external sources we check live versus those we only track and remind on. CQC, NHS ODS, and Companies House are queried live against their public APIs at the point of lookup. GMC verification is performed manually today against the official LRMP register — automated bulk refresh is on the roadmap pending regulator data-access arrangements. NMC, HCPC, GPhC, SWE, and the construction card schemes (CSCS, CPCS, NPORS) are tracked with expiry reminders — Hone stores the number, status and expiry as entered, and reminds the recruiter at configurable thresholds; it does not claim to live-verify the entry against the issuing body. Automated checks against those registers are on the roadmap; we will not describe them as "verified" until they are.
Suspected security incidents go to security@hone.co.uk and we aim to triage within one business day. In the event of a personal data breach affecting workspace data, we will notify the affected workspace Owner(s) without undue delay and in any case within 72 hours of becoming aware of the breach, as required by Article 33 UK GDPR. Notifications include the nature of the breach, the categories and approximate number of records involved, likely consequences, and the mitigation steps taken.
We support customer Data Protection Impact Assessments and will provide our standard DPIA pack — system description, data-flow diagram, sub-processor list, security controls, retention defaults — on request. Email privacy@hone.co.uk.
Hone does not currently hold formal third-party security certifications. Our certification roadmap is, in order: Cyber Essentials, then NHS Data Security and Protection Toolkit (DSPT), then ISO/IEC 27001. We will publish each certificate on this page as it is awarded.
We welcome responsible disclosure of security issues. Report potential vulnerabilities to security@hone.co.uk. We aim to acknowledge receipt within five business days and keep you updated until the issue is resolved. We do not currently run a paid bug-bounty programme but will publicly credit researchers (with their permission) for any reports that result in a fix. Our machine-readable disclosure metadata is published at /.well-known/security.txt.