Security & compliance
Built for HR data from day one.
Hiring data is some of the most sensitive your organization holds. PaiSLEY is built around audit trails, least-privilege access, short-lived media URLs, and deployment options that match your data-residency posture.
Presigned media
15 min expiry
Auth
OTP + magic link
Audit logs
Every event
Withdrawal
Candidate self-service
Role-based access control
Least-privilege defaults, scoped to the job and the person.
- Admin and Recruiter staff roles (Recruiter accounts and per-job assignment on eligible plans), plus applicant accounts.
- Per-job assignment (on eligible plans): recruiters see candidates for the jobs assigned to them and for any job with nobody assigned.
- Password-based authentication for staff. Passwordless OTP and magic link for applicants.
- Configurable session durations, OTP expiry, max attempts, and rate-limit windows.
Audit trail by default
Every meaningful action is captured, attributed, and searchable.
- Every application view, status change, and AI recommendation is logged.
- Job CRUD, user management, login and logout, API tokens, and invite lifecycle captured.
- Filter audit logs by date range, user, or event type.
- Actor attribution on every event with structured metadata.
Data privacy
Resumes and videos stay in private storage, behind links that expire.
- Resume links expire after 15 minutes, video links after an hour.
- Your team signs in to open them. To show an application to someone outside PaiSLEY, you create a share link that expires on a date you choose, up to 30 days away, and you can switch it off sooner.
- Candidates can withdraw an application themselves while it's in progress, which removes their resume and video introduction, and then delete it.
- Staff notification emails name the candidate and the job and link into PaiSLEY; message and client-feedback emails also quote the start of the message or note. PaiSLEY doesn't put resumes, answers or scores in emails, and the daily digest's buttons ask you to confirm on a PaiSLEY page.
Deployment posture
Pick the hosting model that fits your residency and IT policy.
- Self-hosted deployment with full Docker support for enterprise customers with strict residency requirements.
- Managed cloud option with dedicated, branded environments per client.
- Encrypted API key management with connection testing and rotation. No code deploy needed.
- Health-check endpoint for monitoring and uptime tooling.
Compliance by design
Consistent, documented decisions your legal team can defend.
- Consistent screening criteria applied to every candidate.
- Human override on every AI recommendation, documented and timestamped.
- Structured candidate intake reduces ad-hoc, undocumented evaluation.
- Exportable audit log gives compliance and legal teams a clean record.
Need a security review?
We're happy to walk your IT or compliance team through the deployment model, data flows, and audit-log schema during the demo.
Book a security review