Security at Reclyra.

1. Access to application data

Companies work in separate workspaces. Before sensitive data operations, the application checks membership, role and access to the job concerned on the server side. A platform administration role alone does not grant access to a company's applications.

User accounts use a verified email address and a protected session. Sign-in and other security-relevant requests are restricted by rate limits. Customers are responsible for assigning their team permissions and for the secure handling of login credentials and devices.

2. Application files

CVs and supplementary application documents are stored in private file storage. On upload, size, file format and authorisation, among other things, are checked on the server side. File paths are assigned by the application.

Before download and AI processing, ClamAV scans the files in an isolated, short-lived environment. Pending, encrypted or rejected files remain blocked. The release is bound to the content of the scanned file. A security scan cannot rule out every possible threat.

Retrieving a CV requires the appropriate access authorisation. A time-limited download authorisation is then issued. Please share download links and downloaded documents only with authorised persons and keep them appropriately protected.

3. Export, retention and deletion

Authorised workspace managers can export structured applicant data and expressly delete individual applications after a current preview. The deletion also covers the associated internal notes and mentions. Other applications by the same person are retained.

A configured retention period generates a deletion preview from the documented time of rejection. It does not trigger automatic deletion of applications. Setting and complying with an appropriate retention period remains the task of the responsible company.

Associated files are removed by a separate clean-up job. In the event of an error, the job status remains visible and the clean-up can be retried. Files already downloaded, messages sent, download authorisations issued previously and backup copies have their own life cycles; a deletion in the workspace does not recall this content.

4. Traceability and human review

Functional changes, exports and downloads are logged. Deletion jobs receive limited records without application content. Automated tests check, among other things, permissions and the separation of workspaces.

AI evaluations serve to support human review. Reclyra does not use them to make any automatic hiring or rejection decision. Responsibility for selection and decision remains with the respective company.

Information on the processing of personal data can be found in our privacy policy. For a specific application, the privacy notice of the responsible company also applies.

5. Reporting a security problem

You can send reports of possible security problems confidentially to our security contact:

For an initial assessment, the following help us:

• the page or function concerned;
• a short description and reproducible steps;
• the time and the possible impact;
• a way to contact you for follow-up questions.

Please do not send passwords, secret keys, active access links or complete personal data of other persons. Also remove such information from screenshots and logs. For particularly sensitive details, please first agree a suitable transmission method with us.

6. Responsible security testing

When testing, do not access other persons' data and do not change or delete data that is not yours. Avoid load attacks, malware, phishing and deceiving customers or employees. If you unintentionally see other persons' data, stop testing, do not retrieve any further data and report the finding with as little personal information as possible.

These notes do not grant general permission for security tests. Specific authorisation for testing must be expressly agreed in advance. We ask for coordinated disclosure and reasonable time for review and remediation. No public bug bounty programme or entitlement to remuneration is promised hereby.