Authentication and account protection
GreenHired uses industry‑standard mechanisms to protect user accounts.
Passwords are processed using a strong key‑derivation function with multiple iterations and a unique salt per password; raw passwords are never stored.
Multi‑factor authentication (MFA) is supported using time‑based one‑time passwords (TOTP). TOTP secrets are encrypted at rest, and recovery codes are stored in hashed form and are single‑use.
One‑time tokens such as magic links and password reset tokens are generated with sufficient randomness, stored only in hashed form, and are single‑use with short expiry times.
Login attempts are rate‑limited; repeated failures trigger temporary lockouts to reduce the risk of credential‑stuffing and brute‑force attacks.
Sessions and device security
Sessions are designed to balance usability with security.
User sessions are time‑limited with a sliding expiry (for example, around 7 days of inactivity), while elevated admin sessions are significantly shorter (for example, around 4 hours).
Session cookies are marked Secure and scoped with SameSite attributes to reduce the risk of cross‑site attacks.
Device and browser information such as IP address, user‑agent, approximate location, and a pseudonymous fingerprint may be used to detect unusual patterns; a mismatch can cause sessions to be invalidated.
Users can view and revoke active sessions, and changing a password revokes other sessions for that account.
Protection against common web attacks
GreenHired includes measures to reduce the risk of common web security issues.
Cross‑site request forgery (CSRF): a double‑submit cookie plus a request token (for example, an x-csrf-token header) is used on state‑changing requests to ensure they originate from the legitimate session.
Transport security: all traffic to GreenHired is served over HTTPS via Cloudflare, and all cookies are marked Secure so they are not sent over plain HTTP.
Data at rest: databases and storage provided by our hosting platform are encrypted at rest, and especially sensitive fields (such as authentication secrets and certain audit details) are additionally encrypted at the application layer.
Some aspects of CSRF coverage for certain recruiter endpoints are being strengthened, and any commitments made here will be kept aligned with the actual implementation.
Infrastructure, hosting, and storage
GreenHired runs on modern cloud infrastructure with built‑in security features.
Hosting, databases, key‑value storage, and object storage are provided by Cloudflare’s edge platform. These services include encryption at rest and network‑level protections.
Object storage is configured in appropriate regions (for example, EU locations for certain files) while compute and database workloads may run in multiple regions, including the United States.
Only authorised GreenHired staff, authenticated via secure single sign‑on, have admin‑level access to production systems, and their actions are logged for auditability.
Bot, fraud, and abuse protection
To protect the platform and its users from spam, bots, and fraudulent activity, GreenHired uses a combination of tools and checks.
Cloudflare Turnstile and similar mechanisms help distinguish legitimate traffic from automated bots, particularly on high‑risk flows such as signup, login, and contact forms.
IP reputation and intelligence services help identify high‑risk IPs (for example, known VPNs, Tor exit nodes, or suspicious proxies) and inform risk decisions and rate‑limits.
Email deliverability checks at signup help block disposable or obviously invalid email addresses, reducing spam and abuse.
Logging, monitoring, and admin access
Security‑relevant actions are logged and monitored to support detection and investigation of suspicious activity.
Authentication and account‑related events (such as sign‑ins, password changes, MFA events) are recorded with IP and user‑agent data in an audit log.
Usage of AI‑powered features is logged in a way that records metadata (such as which feature was used and how many tokens were processed) without storing raw prompt text, as described in the Privacy Policy.
Administrative actions taken by authorised staff (including impersonation for support purposes) are logged with clear admin markers to maintain an audit trail.
Vulnerability disclosure and responsible security research
GreenHired welcomes responsible disclosure of security issues.
A security contact (for example, a dedicated email address) is provided so that researchers and users can report potential vulnerabilities directly to the security team.
GreenHired aims to operate a good‑faith, safe‑harbour approach for security researchers who follow responsible disclosure practices, test only against their own accounts and data, avoid harming availability or integrity, and give reasonable time to fix issues before public disclosure.
Incident response and breach notification
In the event of a security incident involving personal data, GreenHired follows a structured response process.
Incidents are investigated, contained, and remediated with priority given to protecting user data and restoring normal service.
Where required by data protection laws (such as GDPR/UK GDPR), the relevant supervisory authority will be notified without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying personal data breach.
When a breach is likely to result in a high risk to individuals’ rights and freedoms, affected users will also be informed without undue delay, with clear information and recommended protective steps
Found a security issue?
We welcome responsible disclosure. Email security@greenhired.com with a clear description, reproduction steps and your contact details — we'll acknowledge within two business days and keep you posted while we triage.