TrueNorth handles resumes, contact details, and government IDs every day. Here's exactly how we protect that data — in plain language, with nothing hand-waved.
Defense in depth — from the database up to the role that reads a single field.
Sensitive identifiers — SSN, PAN, Aadhaar — are encrypted at rest at the individual field level and masked to the last 4 digits. Plaintext is never returned by the API.
A five-role hierarchy (from CEO to junior recruiter) with JWT authentication. Every request is authorized at the API, so users only ever reach the data their role permits.
Access to sensitive candidate and employee data is logged — so there's always an answer to who viewed what, and when.
All traffic is served over TLS. The database runs on a private network and is never exposed to the public internet.
Continuous point-in-time recovery plus scheduled backups protect against data loss and let us restore to a precise moment if needed.
A single, region-aware codebase runs in the US or India with data — including resume storage — kept in your region.
TrueNorth runs from one codebase with a region flag — so US and India customers get the same product, with data resident where their compliance requires.
US instance with resume storage in a US-region bucket and US-region database. Work authorization, W-2/1099/C2C classification, and USD billing are first-class.
India instance with resume storage in an India-region bucket. Aadhaar e-sign, PAN handling, and INR billing are supported natively — data resident in India.
TrueNorth runs on SOC 2 Type II–audited cloud infrastructure. We don't claim certifications we don't hold — instead we're transparent about exactly who processes your data and why.
| Sub-processor | Purpose | Data |
|---|---|---|
| Railway | Application hosting & PostgreSQL database | All application data (encrypted at rest) |
| AWS S3 | Resume & document storage | Resumes, agreements (region-resident) |
| Google Cloud | Gemini AI parsing & matching; Drive/Gmail import | Resume text for parsing |
| Resend | Transactional email | Names & email addresses |
| Sentry | Error monitoring | Diagnostic data (PII scrubbed) |
We'll share a written security overview and answer your questionnaire. Tell us what your procurement team needs.