Security and data
Applications contain personal information about people who have not agreed to anything beyond applying for a job. That deserves care.
We are a small company and hold no security certifications, such as SOC 2 or ISO 27001. This page describes what we actually do today. If it does not answer your question, ask us.
Practices
Resumes and cover letters, applicants’ contact details and screening answers, and the notes and decisions your team adds. From those we extract the resume text and produce an assessment against your requirements, with the evidence. It is all stored in your account.
Applicant data stays until you delete it. Admins can delete every applicant older than an age they choose, and we delete individual applicants on request. The account owner can export everything, or ask us to delete the whole account, including resumes, files and logs.
Each account’s data is kept separate from every other account’s in the database. Team members have roles (Owner, Admin, Recruiter, Viewer), and significant actions such as exports are recorded in an audit log. Our staff look at customer data only to support you, fix a problem or meet a legal obligation.
Resumes are assessed with OpenAI models through OpenAI’s API. OpenAI states that API data is not used to train its models unless the customer opts in, which we have not, and is kept for up to 30 days for abuse monitoring. We do not train AI models on applicant data.
Supabase (database, file storage and sign-in), OpenAI (resume assessment), Postmark (application email), Resend (website email), Stripe (payments) and Cloudflare (website hosting and security). They may process data outside Canada, including in the United States.
Every connection to the website and the application is encrypted with HTTPS. Uploaded resumes are checked to be real PDF or Word files, and applications are rate-limited to slow down abuse.
Human decisions
Applicants are set aside automatically only by rules you choose. A knockout rule checks a screening answer exactly as you configured it, with no AI involved. If you switch on marking clear mismatches for a job, which is off by default, the AI assessment can also set an applicant aside. Both are logged with their reason and can be overridden.
No one is sent a rejection unless someone on your team sends it. Candidates only hear from you when you choose to contact them, apart from routine notices: a receipt when they apply, a request to answer your screening questions, and a neutral update when a role they interviewed for is filled. The software narrows what a person reads. A person makes every decision about who progresses.
Structured screening can make your criteria explicit and apply them consistently across a batch. We do not claim it removes bias, and we do not claim it predicts how anyone will perform in a job.
Security questions go to support@sortthestack.com.
Send us your questionnaire and we will answer what we can, honestly, including where the answer is still being worked on.