Security
Hiring data, handled carefully.
Résumé files, phone numbers and interview notes need tested access controls. This page explains which controls to verify before a pilot handles live applicant data.
The Apex ATS source includes tenant access checks, private résumé handling and provider safeguards. The current production schema, access boundaries, hosting settings and provider connections must be verified before live applicant records are used. Contact [email protected]with security questions.
Employer-scoped records
The pilot is designed to separate recruiting records by employer. Access boundaries must be verified in the active database and with the assigned user roles before live applicant data is entered.
Database and role controls
The source includes organization-scoped access checks and Row Level Security policies. The production schema and policy state still require reconciliation and acceptance testing before these controls can be relied on for customer records.
Résumé access
Résumé downloads use private storage and short-lived links where that feature is enabled. Verify upload, authorized download and cross-employer denial in the production workspace before testing with real résumés.
Provider controls
Zoho Recruit, email and SMS actions remain unavailable until the relevant account, scopes, secrets, callback routes and employer mapping are configured and verified. Provider credentials belong in server-side secrets, never client forms.
Retention and recovery
Retention, export and recovery arrangements are confirmed in the written pilot and provider terms. Do not assume a particular backup schedule or deletion window without written confirmation.
Release verification
Before a pilot uses live applicant data, verify the deployed source, database migrations, server-side secrets, authentication, logs and provider callbacks against the release checklist.
Subprocessors
Who touches the data.
Providers receive data only through the features enabled for a workspace. Confirm the current provider list, processing region and applicable terms in writing.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Managed Postgres database, authentication and file storage | AWS, United States |
| Cloudflare | Hosting, CDN, TLS termination, DDoS protection | Global edge, US origin |
| Twilio | SMS delivery and inbound messages (customer-connected account) | United States |
| Resend | Transactional email delivery | United States |
| Zoho Recruit | Recruiting records sent by authorized Zoho actions | Confirm for connected account |
Pilot checks
Verify before live use.
- Confirm the current production migration and database policy state.
- Test owner, recruiter and employer-specific access with separate accounts.
- Verify private résumé upload and authorized download boundaries.
- Check server-side provider secrets and webhook signatures for enabled channels.
- Test a controlled provider round trip and inspect duplicate/retry behavior.
- Agree retention, export, deletion and incident terms in writing before live use.
Responsible disclosure
Found something?
Email [email protected] with the steps to reproduce. Please avoid accessing other customers' data, degrading the service, or social engineering our team; report and stop.
- Where is my data stored?
- The active Supabase project and provider account determine processing regions. Confirm the project's region and applicable provider terms before a pilot handles applicant data.
- Do you have SOC 2 or ISO 27001?
- Ask us for current compliance and security documentation. Do not infer an Apex certification from the certifications of an infrastructure provider.
- Can I get a signed DPA?
- Review the published data-processing text with Apex. Applicability, signature and any required transfer terms must be agreed in writing before applicant data is processed.
- How do I report a vulnerability?
- Email [email protected] with the issue and steps to reproduce. Avoid accessing another employer's data or disrupting the service; we will review the report and follow up.