fbpx

Security

Tigon Recruiter provides recruiting communication management services that allow recruiters to more efficiently source and engage with potential candidates. These services include email management, response tracking, and statistics to inform the efficacy of your recruiting efforts.

There are two components to the Tigon Recruiter (“Tigon”) services:

  1. Our web application interface, Tigon-recruiter.com, where you can manage all of your outreach campaigns and reports

  2. A Chrome extension which is a tool for enabling your sourcing efforts

To access the Tigon Recruiter services, you will need to create a Tigon account.

Your Tigon account login credentials will be tied to your email account, so you’ll need to grant Tigon permission to create that relationship through a technical standard called OAuth. The security of your data is our highest priority, so Tigon will only interact with your other accounts via secure APIs. For clients using Gmail, we use the official Google APIs over SSL with user authentication done exclusively via Google SSO; for clients using Outlook, we use the Nylas API. In addition to this process being easier for users to manage by not having to remember another set of login credentials, we also believe this is more secure, since Tigon never sees or stores user passwords.

During the account creation process, your email provider will ask you to verify that the permissions we request are appropriate. The permissions we ask for, and the reasons we need them, are as follows:

Tigon needs Read and Send access to your inbox:

  • Tigon needs Send access because it sends emails as you from your Gmail inbox. This means your messages will look exactly like they were sent from your Gmail inbox and will show up in your Sent Mail folder.

  • Tigon needs Read access to your inbox so it can stop automated follow-ups in your sequences in the instance when a candidate replies to your email outreach. Also, at your preference we would be able to automatically classify candidates’ replies into interested / non-interested.

Once your Tigon account has been created, we store a minimal amount of your information going forward. We only store to/from email addresses and timestamps for emails in your inbox to power our feature that ensures your team doesn’t reach out to the same person twice.

For users authenticating with a Google account; Tigon Software’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

We DO NOT store the contents of any emails in your inbox except for emails you send in Tigon through sequences, and a candidate’s first reply to a Tigon sequence.

In addition to only interacting with your other accounts through secure APIs, we also protect your data throughout our system. All data at rest is encrypted using AES-256, via Amazon RDS’s implementation, and all data in transit is encrypted using browser-based TLS. We also make use of a wide range of administrative and technical safeguards to ensure the Tigon services operate in a safe environment.

The Tigon services have been designed and developed with industry-leading cloud PaaS and LaaS providers. We use AWS for our application servers and for our databases, along with a few other AWS services without significant customer data or permissions. These providers maintain industry-standard security certifications, including ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3 and PCI DSS Level 1. Through the use of these scalable platform providers, we are able to leverage a number of features to allow us to minimize any potential impact to the availability of Tigon and your data in the event of any potential natural disasters or system failures.

Tigon has implemented a comprehensive set of internal security policies and programs to ensure that we are able to continually develop our services in the most secure way possible, allowing you to use Tigon in a variety of environments subject to additional regulatory oversight such as HIPAA or OFCCP compliance. Tigon has also been certified as adhering to the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks to allow for the transfer of personal data from the EU and Switzerland to our hosted AWS environments within the US.

As part of our commitment to providing a safe and secure service for the management of your private candidate data, we have developed Tigon to operate within the requirements of the General Data Protection Regulation (GDPR) . GDPR is a European privacy law that went into effect on May 25th, 2018. It is based upon the European understanding that privacy is a fundamental human right. Established by the EU Parliament, the GDPR regulates how individuals and organizations can obtain, use, store, and remove personal data. It gives EU citizens and residents control over their personal data, and simplifies the regulatory environment for international business that takes place in the EU.

Here is an overview of how Tigon has prepared to meet the new regulation requirements:

  • We offer a data processing addendum (DPA) for our customers who collect data from people in the EU. Our DPA offers contractual terms that meet GDPR requirements and that reflect our data privacy and security commitments to our customers.

  • We reviewed and identified all the areas of Tigon where we collect and process customer data. We validated our legal basis for collecting and processing personal data, and we ensured that we apply the appropriate security and privacy safeguards across our infrastructure and software ecosystem. Our Privacy Policy identifies what we do with the data we collect and how we manage consent.

  • We are committed to helping our customers meet the data subject rights requirements of GDPR. Tigon processes or stores all personal data with fully vetted vendors with whom we have a DPA in place. We store personal data until your account is deleted, after which we dispose of all data in accordance with our Terms of Service and Privacy Policy.

  • One of the GDPR requirements is a managed data protection impact assessment (DPIA) process. A DPIA process is a way to help us identify and minimize the data protection risks of a project. Tigon engineering team has always undergone security and privacy due diligence when choosing tools and making implementation decisions, so this requirement is easy for us. Any time we introduce a change to the way we handle personal data, we discuss the potential impact on Tigon customers and explore possible privacy and security risks to personal data. If any risk is identified, no matter how small, our product and engineering teams collaborate on a solution to mitigate the data privacy and security risk to anyone who interacts with the Tigon platform. We will continue to execute this risk assessment process as we expand Tigon’s offerings.

To help us continue to maintain the most secure platform possible, we are performing regular vulnerability scans at both the network and application level to ensure our compliance with both WASC (Web Application Security Consortium) and OWASP (Open Web Application Security Project) standards.