Trust at Nexu HR
How we protect the data companies trust Hirlen with, what we promise about privacy and AI, and how to tell us when something is wrong.
Security
These controls run in Hirlen today.
Encryption
Traffic is encrypted with TLS 1.3. Data at rest in the database and file storage is encrypted with AES-256.
Row-level security
Every table has Postgres row-level security. A user cannot read or write another company’s rows, whatever the application does.
Access control
Role-based access with built-in roles. Confidential vacancies are visible only to their hiring panel.
Backups
Daily automated backups with point-in-time recovery for the last 24 hours. Customers can export their data at any time.
Activity logs
Sensitive actions such as phase changes, employee data updates and settings changes are recorded in each company’s activity log.
Vendors
Every sub-processor works under a data processing agreement with obligations at least as protective as ours.
Compliance, plainly
Hirlen runs on infrastructure from Supabase, Vercel and Cloudflare, which hold SOC 2 and ISO 27001 for their services. Nexu HR Inc. does not hold its own SOC 2 or ISO 27001 certification yet, and we will not say otherwise until an audit is done.
Privacy commitments
- Customer data belongs to the customer and is processed only to provide the service.
- Every customer can sign our Data Processing Agreement.
- Our sub-processors are listed publicly, with notice before a new one is added.
- Data can be exported at any time, and is deleted after an account closes.
- Google user data from the Calendar integration is never used to train AI models.
How we use AI
- A person always makes the hiring decision. AI ranks, drafts and summarises; the decision stays with your team.
- Scores come with their reasons in plain words, so they can be checked and challenged.
- Customers choose their AI provider in settings and see each provider’s data terms, including whether it may use data to improve its models.
- The AI providers Hirlen uses are listed among its sub-processors.
Report a vulnerability
If you think you have found a security problem in Hirlen or on this site, write to security@nexuhr.com. We acknowledge reports within one business day, we do not take legal action against researchers acting in good faith, and we credit reporters unless they prefer to stay anonymous.
Email security@nexuhr.comAI provider
May use data to improve models- Provider ANo
- Provider BYes
- Provider CNo
Hirlen documents
The binding terms for the product live on hirlen.com.