<aside> ⚠️ This guide outlines frequently asked questions from security teams. Please note that this page is for informational purposes only. Although we do our best to keep this information up-to-date, you should always refer to our Terms, Privacy Policy, or your signed agreements with Ashby for the most accurate information. Please reach out to [email protected] if you have questions not addressed in this page.

</aside>

What Ashby Does

Ashby is an all-in-one recruiting platform that replaces several classes of software your Talent team uses. As a result, Ashby’s integration with your company’s IT systems will require the same access as the software it replaces. Below is a summary of what we replace that requires access to sensitive data (and consequently is relevant to a security risk assessment).

We ask for the minimum access necessary to provide your Talent team with the full suite of functionality available from these comparable products. While we provide integration options for less information to be accessed by Ashby, it also comes at a cost to functionality and benefits to your Talent team. This document aims to help you assess your options and their tradeoffs to make an accurate risk assessment of Ashby.

Security, Privacy, and Reliability at Ashby

The integrations we request give Ashby access to data sensitive to your company, and we take this responsibility seriously. We conduct an annual SOC2 Type II audit and White-Box pentest and use vulnerability detection software for infrastructure, third-party packages, and our application (via a DAST). We also employ a global team of reliability engineers to ensure high availability and security for users at any scale. For further details, please read our security overview or contact our security team at [email protected].

We also provide features and resources for maintaining compliance with privacy regulations such as GDPR and CCPA. For GDPR, see our page outlining how to use Ashby to maintain compliance.

Ashby's Access to Google Workspace & Office 365

Our integrations with Google Workspace and Office 365 increase the risk profile of Ashby as a vendor, but provide significant benefits to your Talent team. To support several features that increase the speed and efficiency of your hiring, Ashby requests access to the emails and calendars of your team members involved in the hiring process. Ashby will store a subset of this data in our database to allow us to provide a fast and reliable user experience. Our database is encrypted at rest, logically separated by customer, and behind a VPC. All data transmitted between your IT systems, Ashby’s servers, and Ashby’s clients are encrypted in transit. For more information, please read our security overview.

Benefits of Access

This section explains the benefits Ashby provides for the access we request. Without this access, the functionality described will not be available.

Email

When Ashby can send email through your email provider (e.g., Gmail), your Talent team and hiring managers can utilize the following functionality:

• Send emails using predefined templates in Ashby. This creates a consistent candidate experience, from standardizing rejection explanations to how offers are made.
• Send emails on behalf of another user. For instance, this can be used to automatically email a candidate from the hiring manager or recruiter upon moving them to a certain stage.

https://lh7-us.googleusercontent.com/DdcvAhHIlnT8NYajNSA6XXarVyY4-nnomSwKE1R5X1iBkiH0XGNfSyQYfDf5FpkvTROGifc_yQxVX_IU4FJ8HKygjhyWg49IwCRtt0dwTRqKEkgs0IdvssnTKMVmeB2xYEsvforlujvg1GPv4iX3AqY

When Ashby can read emails through your email provider, your Talent team and hiring managers can utilize the following functionality:

• Send sequences of emails to attract passive candidates. The sequence is paused when the candidate replies; this requires reading the email of the sequence sender. Most Talent teams make a significant percentage of hires from passive candidates.