Keeping your candidates' data safe.
Recruitment runs on personal data. Here's how Helixon protects it, in plain terms. Our Data Processing Agreement has the formal version.
Where data lives
The database and file storage are in Zurich, Switzerland, which the UK and EU recognise as adequate. Everything is encrypted in transit (TLS 1.2 or later) and at rest (AES-256).
Each agency kept apart
Every query is limited to the agency of the person asking, and the database checks it again on its own, so one agency can't reach another's candidates, clients or files.
CV files
Original CVs are stored privately and only ever opened through links that expire after one minute.
Signing in
Sign-in is handled by Clerk. Workspaces can require two-step verification for everyone, and use single sign-on through Microsoft Entra ID, Okta, Google Workspace or any SAML provider.
Who sees what
Owners and admins decide what members see: money, everyone's candidates or only their office's or their own, and who can delete candidates or send them to clients - as workspace defaults or custom roles.
An audit log
Deleting, exporting and changing settings is recorded with who did it and when, for owners and admins to review.
AI
CVs and job descriptions are analysed by Anthropic's Claude under terms that don't allow them to be used to train models.
Keeping only what's needed
Candidates nobody has touched for your chosen retention period are erased automatically, and all candidate and CV data is deleted 90 days after a subscription ends. Erasure requests remove every record about the person.
Our own access
Helixon staff reach customer workspaces only when needed for support, and that access is logged.
Watching for trouble
A firewall scores incoming requests and blocks abusive ones automatically, sign-in and API use are rate limited, and dependencies are scanned for known vulnerabilities continuously.
Certifications
Helixon doesn't hold Cyber Essentials or ISO 27001 certification yet. When it does, the certificates will be listed here with their numbers so you can check them. Until then, we're happy to answer a security questionnaire - email hello@helixon.co.uk.
Who processes data for us
Hosting, the database, AI analysis, sign-in, email, payments and texting are provided by named sub-processors, each under data protection terms. The full list, with what each does and where, is in Annex B of the DPA.
If something goes wrong
We tell affected customers without undue delay, and within 48 hours of becoming aware of a breach of their data, with what they need for their own reporting. Live service health is on the status page.
Reporting a vulnerability
If you think you've found a security problem, email support@helixon.co.uk with how to reproduce it. Please don't access or change other people's data while testing, and give us a reasonable time to fix it before telling anyone else. Our contact details are also in security.txt.