Security at Kadroflow

Every item below is a mechanism in the product that can be demonstrated in a live workspace, or a fact taken from its deployment configuration. Nothing here is a certification, an audit result or a promise about a future release.

Kadroflow is a processor for candidate and employee data: the customer decides why and how that data is used, and Kadroflow holds it on their behalf. It is a controller for its own account, billing and security data. The Privacy Notice sets out both roles in full.

The services that process customer data, what each one does and where it runs. A customer is notified before a new subprocessor starts processing, with a reasonable window to object.

The optional connections at the bottom of the table process nothing until a user in the workspace authorises them, and stop when that authorisation is withdrawn.

Candidate records, jobs, interviews, offers and employee data are stored in a Postgres database in Frankfurt. Files — CVs, certificates, interview recordings, offer documents — are held in object storage pinned to the EU jurisdiction. Text AI runs against Mistral's EU endpoint, which is set in configuration rather than left to a default, because the unpinned host carries no location guarantee and every prompt contains a CV, a salary figure or an interview note.

The exception is speech-to-text. Interview recordings are transcribed by Cloudflare Workers AI, which carries no EU-only inference guarantee. This is a deliberate choice, not an oversight: the EU-pinned alternative cannot transcribe Slovenian — it rejects the language outright and its auto-detection rendered a Slovenian interview as fluent Russian, which then reached a recruiter as interview evidence. A configuration switch reverts to the EU-pinned provider at the cost of Slovenian transcription.

Authorisation is enforced in the database, not in application code. Every table carries row-level security scoped to the workspace, evaluated on every query against the identity attached to that transaction. A mistake in a query returns nothing rather than somebody else's candidates, and a route that forgot to filter cannot leak across organisations because the filter is not the route's to forget.

Roles — owner, admin, recruiter, hiring manager, interviewer — see different things, and the difference is enforced in the same place.

Sensitive free text is encrypted field by field inside the database, not only on the disk underneath: AI analyses and their evidence, interview transcripts, documents and offer content, and salary figures. Reads go through a view that decrypts only what the requesting role is allowed to see.

Names, email addresses and locations are stored in the clear so that lists, search and deduplication work. They are protected by workspace isolation and access control rather than by encryption, and that is a deliberate trade-off rather than an omission.

One limitation, stated plainly: the encryption key is currently held inside the same database as the data it protects. That means a backup contains both, and that destroying the key is not yet a way to erase data. Moving the key to a separate secret store is planned; until it is done, erasure is performed by deleting records and objects, and by the recovery window behind them expiring.

That window is short, and it is worth stating as a number rather than as a reassurance. The database keeps 24 hours of point-in-time history; after that, no recoverable copy of a deleted record exists anywhere. File storage keeps no version history at all, so a deleted CV, certificate, recording or offer document is gone at the moment it is deleted.

Interview recordings are deleted automatically. The period is set by the workspace plan — 30 days on Free, 90 on Plus, 180 on Pro, 365 on Max — and is fixed at the moment the candidate consents. If a plan later changes, a recording is never held for longer than the candidate was told, and a shorter period is never applied retroactively to shorten what was promised.

Candidate records are controlled by the customer, who decides how long a hiring process retains them and can delete a candidate or export a whole workspace at any time. A candidate can ask for a copy of their data or for its deletion directly from their own application page; the request reaches the employer with a one-month deadline, and a person decides.

A workspace can also set an expiry for closed records — the record itself, not only the CV file: name, contact details, analysis and interview evidence are erased a chosen number of months after a candidate is rejected or withdraws. It is counted from the moment the process ended rather than from the application, so a long process is never cut short, and it never touches a candidate still in a pipeline, anyone on legal hold, or someone who was hired. It is off until an owner turns it on, because deleting someone's record is not a default worth assuming.

Legal hold exempts a candidate, a document or a recording from automatic deletion while a dispute or an investigation is open, and records who applied it.

Closing a workspace starts a 30-day window in which the data can still be exported, after which records and the objects behind them are deleted and the completion is logged.

Sign-in is email and password or Google, with two-factor authentication by time-based code and single-use backup codes. A session has a 30-day absolute lifetime and can be revoked from any device. Signing in from a network the account has never used sends a confirmation code to the account's email before the session can be used.

A workspace can require that every member's email address belongs to a domain the organisation has proven it controls, verified by a DNS record.

Every sign-in, permission change and hiring decision is recorded in an append-only trail.

Kadroflow analyses applications and interview transcripts. It does not decide. The preselection gate flags candidates who fail a stated requirement and never declines anyone; a database rule rejects any attempt by an automation to move or reject a candidate, so an automated rule can only ever suggest a next step for a person to confirm.

The score is arithmetic computed in code from evidence the model extracted, not a number the model chose. Every claim must quote a verbatim span of the source document; a claim whose quote cannot be found in the source is discarded, and an analysis with no surviving citations fails rather than being published.

The analysis is instructed not to consider protected characteristics, and a workspace's own AI settings cannot override that rule. Model, prompt version and inputs are recorded for every run.

Under the EU AI Act, recruitment AI is a high-risk system and Kadroflow is its provider. The obligations apply from 2 December 2027. Our provider documentation, including the gaps still open, is maintained alongside the product.

A reviewer will ask about these within the first few minutes, so they are here rather than further away.

• No SOC 2 report and no ISO 27001 certificate. The controls above are real and demonstrable; none of them has been audited by a third party.
• No published penetration test.
• No single sign-on against a customer identity provider, and no SCIM. Authentication is email and password, Google, and two-factor codes.
• The data processing agreement is not yet published. It is in preparation; ask us and we will send the current draft.

If any of these is a requirement for you, say so — knowing which ones block a purchase is how they get prioritised.

Send security reports to support@kadroflow.com. Please include enough detail to reproduce the issue. We will confirm receipt, keep you informed while we work on it, and will not pursue anyone who reports a genuine finding in good faith without accessing other people's data.