Security & compliance
Built for HR data from day one.
Hiring data is some of the most sensitive your organization holds. PaiSLEY is built around audit trails, least-privilege access, short-lived media URLs, and deployment options that match your data-residency posture.
Presigned media
15 min expiry
Auth
OTP + magic link
Audit logs
Every event
GDPR
One-click withdrawal
Role-based access control
Least-privilege defaults, scoped to the job and the person.
- Admin and Recruiter staff roles (Recruiter accounts and per-job assignment on Growth and Pro), plus applicant accounts.
- Per-job assignment (Growth and Pro): recruiters see candidates for the jobs assigned to them and for any job with nobody assigned.
- Password-based authentication for staff. Passwordless OTP and magic link for applicants.
- Configurable session durations, OTP expiry, max attempts, and rate-limit windows.
Audit trail by default
Every meaningful action is captured, attributed, and searchable.
- Every application view, status change, and AI recommendation is logged.
- Job CRUD, user management, login and logout, API tokens, and invite lifecycle captured.
- Filter audit logs by date range, user, or event type.
- Actor attribution on every event with structured metadata.
Data privacy
Sensitive media stays behind authenticated, short-lived links.
- Video and resume files served via short-lived presigned URLs (15 minute expiry).
- Media is never publicly accessible. Every access goes through portal auth.
- Self-service withdrawal triggers full data deletion or anonymization, supporting GDPR's "right to be forgotten".
- Staff notification emails name the candidate and the job and link into PaiSLEY; message and client-feedback emails also quote the start of the message or note. PaiSLEY doesn't put resumes, answers or scores in emails, and the daily digest's buttons ask you to confirm on a PaiSLEY page.
Deployment posture
Pick the hosting model that fits your residency and IT policy.
- Self-hosted deployment with full Docker support for enterprise customers with strict residency requirements.
- Managed cloud option with dedicated, branded environments per client.
- Encrypted API key management with connection testing and rotation. No code deploy needed.
- Health-check endpoint for monitoring and uptime tooling.
Compliance by design
Consistent, documented decisions your legal team can defend.
- Consistent screening criteria applied to every candidate.
- Human override on every AI recommendation, documented and timestamped.
- Structured candidate intake reduces ad-hoc, undocumented evaluation.
- Exportable audit log gives compliance and legal teams a clean record.
Need a security review?
We're happy to walk your IT or compliance team through the deployment model, data flows, and audit-log schema during the demo.
Book a security review