EmployJoy trust center

Trust and security

How we protect the employers we work for and the people who apply to work for them.

TCPACompliant
CPRAReady
SOC 2In progress

Controls

Reviewed July 2026

Reviewed by our team, not auto-generated. When our SOC 2 audit completes, this page will link to the report.

Infrastructure security

  • HTTPS enforced with strict transport security
  • Security headers set on every response
  • Unique account authentication enforced
View 1 more control
  • US-based hosting on AWS and Vercel

Product security

  • Data transmission encrypted in transit
  • File uploads validated by type and content
  • Database queries parameterized through the ORM
View 2 more controls
  • Rate limiting and security middleware on the API
  • Administrative actions recorded in audit logs

Organizational security

  • Two-factor authentication required for staff and recruiters
  • Access to employer and candidate data scoped by role
  • Subprocessor list maintained and published

Data and privacy

  • Only the data an application requires is collected
  • Personal information is never sold
  • Access and deletion requests honored
View 2 more controls
  • Candidate texting is consent-based with quiet hours
  • Interview recordings stored on AWS

AI safeguards

  • AI-assisted screening is reviewed by people
  • Hiring decisions stay with the employer
  • Messages to candidates identify EmployJoy

Subprocessors

These services process data on our behalf.

Amazon Web Services
Application hosting and file storage
Vercel
Website hosting
Stripe
Payments
Twilio
Text messages and calls
Mailjet
Email delivery
Anthropic
AI processing
Google
Sign-in
Hireflix
Video interviews

The data we work with

To run hiring for an employer, we collect what an application requires: contact details, work history, availability, and recorded video interviews. Candidates see who they are applying to, and employers receive a shortlist of people we have already screened and interviewed. We use this data to run the hiring process and to improve how we screen. We do not sell it.