{"id":54167,"date":"2026-02-01T12:30:21","date_gmt":"2026-02-01T18:30:21","guid":{"rendered":"https:\/\/heartbeat.ai\/healthcare\/security-overview\/"},"modified":"2026-08-31T08:46:00","modified_gmt":"2026-08-31T13:46:00","slug":"security-overview","status":"publish","type":"post","link":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/","title":{"rendered":"Security Overview for Recruiting Data (Procurement + IT)"},"content":{"rendered":"<p class=\"article-last-updated\"><strong>Last updated:<\/strong> August 31, 2026<\/p>\n<p><img decoding=\"async\" loading=\"false\" class=\"aligncenter\" src=\"http:\/\/hc.heartbeat.ai\/wp-content\/webp-express\/webp-images\/uploads\/2026\/02\/security-overview-a81384b5.png.webp\" alt=\"54166\" \/><\/p>\n<p><strong>Ben Argeband, Founder &amp; CEO of Heartbeat.ai<\/strong> \u2014 No compliance cosplay. We&#8217;ll tell you what&#8217;s in-product, what&#8217;s process, and what&#8217;s <strong>available on request<\/strong> so procurement can file it and move on.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\r\n<div class=\"ez-toc-title-container\">\r\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">What\u2019s on this page:<\/p>\r\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\r\n<nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Who_this_is_for\" >Who this is for<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Quick_Answer\" >Quick Answer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Framework_procurement_checklist_tone_no_hype\" >Framework: procurement checklist tone, no hype<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Scope_and_boundaries\" >Scope and boundaries<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Controls_summary_Heartbeatai\" >Controls summary (Heartbeat.ai)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Recommended_controls_buyer_checklist\" >Recommended controls (buyer checklist)<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Step-by-step_method\" >Step-by-step method<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#1_Define_your_recruiting_data_scope\" >1) Define your recruiting data scope<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#2_Validate_access_control_against_your_org_chart_not_the_vendors_UI\" >2) Validate access control against your org chart, not the vendor&#8217;s UI<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#3_Confirm_encryption_scope_dont_assume_it\" >3) Confirm encryption scope; don&#8217;t assume it<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#4_Treat_exports_and_permission_changes_as_the_highest-risk_events\" >4) Treat exports and permission changes as the highest-risk events<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#5_Review_incident_response_at_a_%E2%80%9Chigh-level_but_real%E2%80%9D_layer\" >5) Review incident response at a &#8220;high-level but real&#8221; layer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#6_Ask_for_subprocessor_transparency\" >6) Ask for subprocessor transparency<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#7_Confirm_retention_deletion_expectations\" >7) Confirm retention &amp; deletion expectations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#8_Tie_controls_to_recruiting_outcomes\" >8) Tie controls to recruiting outcomes<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Diagnostic_table\" >Diagnostic table<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Weighted_checklist\" >Weighted checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Outreach_templates\" >Outreach templates<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Template_1_security_overview_request\" >Template 1: security overview request<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Template_2_evidence_follow-up_on_exports_and_logging\" >Template 2: evidence follow-up on exports and logging<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Template_3_corrections_and_transparency_workflow\" >Template 3: corrections and transparency workflow<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Common_pitfalls\" >Common pitfalls<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#How_to_improve_results\" >How to improve results<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Legal_and_ethical_use\" >Legal and ethical use<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Evidence_and_trust_notes\" >Evidence and trust notes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#FAQs\" >FAQs<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#What_should_a_security_overview_include_for_recruiting_data\" >What should a security overview include for recruiting data?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#What_evidence_should_procurement_request_from_Heartbeatai\" >What evidence should procurement request from Heartbeat.ai?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Why_are_exports_and_permission_changes_treated_as_high_risk\" >Why are exports and permission changes treated as high risk?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#How_can_we_speed_up_vendor_risk_review_without_slowing_recruiting\" >How can we speed up vendor risk review without slowing recruiting?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#What_should_we_ask_for_to_complete_a_vendor_risk_questionnaire\" >What should we ask for to complete a vendor risk questionnaire?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-32\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#What_does_%E2%80%9Cavailable_on_request%E2%80%9D_mean_in_procurement_terms\" >What does &#8220;available on request&#8221; mean in procurement terms?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-33\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#Next_steps\" >Next steps<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-34\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#About_the_Author\" >About the Author<\/a><\/li><\/ul><\/nav><\/div>\r\n<h2><span class=\"ez-toc-section\" id=\"Who_this_is_for\"><\/span>Who this is for<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This is written for procurement and IT reviewers evaluating Heartbeat.ai, or any vendor supplying healthcare provider phone and email data for recruiting outreach. It&#8217;s meant to give you a procurement-ready overview of access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and how corrections get made.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Quick_Answer\"><\/span>Quick Answer<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<dl>\n<dt>Core Answer<\/dt>\n<dd>Validate access control, encryption scope, audit logs, incident response, subprocessor transparency, and retention\/deletion for recruiting data\u2014then require a corrections workflow and change log to keep trust current.<\/dd>\n<dt>Key Insight<\/dt>\n<dd>In recruiting tools that handle provider phone numbers and emails, exports and permission changes are the highest-risk moments. If those aren&#8217;t permissioned and logged, governance is mostly paperwork.<\/dd>\n<dt>Best For<\/dt>\n<dd>Procurement + IT reviewers running vendor risk review for healthcare recruiting workflows.<\/dd>\n<\/dl>\n<blockquote>\n<p><strong>Compliance &amp; Safety<\/strong><\/p>\n<p>This method is for legitimate recruiting outreach only. Always respect candidate privacy, opt-out requests, and local data laws. Heartbeat does not provide medical advice or legal counsel.<\/p>\n<\/blockquote>\n<h2><span class=\"ez-toc-section\" id=\"Framework_procurement_checklist_tone_no_hype\"><\/span>Framework: procurement checklist tone, no hype<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Procurement reviews stall when a vendor blurs what&#8217;s implemented against what&#8217;s merely recommended. Use the structure below to keep answers auditable. Control availability can vary by configuration, so request an evidence pack for your specific review rather than relying on marketing copy.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Scope_and_boundaries\"><\/span>Scope and boundaries<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>This page covers:<\/strong> security controls and review artifacts relevant to recruiting data workflows involving provider contact information.<\/li>\n<li><strong>This page does not replace:<\/strong> your organization&#8217;s vendor risk questionnaire, legal review, or a signed security addendum.<\/li>\n<li><strong>Shared responsibility:<\/strong> your internal policies (user offboarding, export policy, acceptable use) matter as much as vendor controls.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Controls_summary_Heartbeatai\"><\/span>Controls summary (Heartbeat.ai)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Access control:<\/strong> role-based access patterns and least-privilege intent for user permissions.<\/li>\n<li><strong>Audit logs:<\/strong> logging for key user and administrative actions, including exports and permission changes, to support investigations and internal review.<\/li>\n<li><strong>Incident response:<\/strong> a defined process for triage, containment, communication, and remediation at a high level.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Recommended_controls_buyer_checklist\"><\/span>Recommended controls (buyer checklist)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Encryption scope:<\/strong> confirm encryption in transit and at rest for your specific data flows; request scope and evidence.<\/li>\n<li><strong>Export governance:<\/strong> restrict exports by role, log exports, and review export activity on a defined cadence.<\/li>\n<li><strong>Subprocessor transparency:<\/strong> maintain a current list of subprocessors and what they do.<\/li>\n<li><strong>Retention &amp; deletion:<\/strong> define retention windows and deletion expectations for recruiting data and audit logs.<\/li>\n<li><strong>Corrections workflow:<\/strong> a clear intake for reporting issues and a visible change log pattern showing date, what changed, and why.<\/li>\n<\/ul>\n<p>If you need artifacts for your file \u2014 a role matrix, encryption scope summary, audit log field list, incident response overview, subprocessor list, or retention\/deletion summary \u2014 they&#8217;re <strong>available on request<\/strong>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Step-by-step_method\"><\/span>Step-by-step method<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1_Define_your_recruiting_data_scope\"><\/span>1) Define your recruiting data scope<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Before sending a questionnaire, write down what counts as recruiting data in your environment. Typical categories for healthcare recruiting include:<\/p>\n<ul>\n<li>Candidate identifiers: name, email, phone<\/li>\n<li>Professional details: specialty, employer, location<\/li>\n<li>Outreach metadata: timestamps, message content, opt-out status<\/li>\n<li>User activity: logins, exports, admin actions<\/li>\n<\/ul>\n<p>Skipping this step is a common failure mode: the vendor answers a generic question, but your risk team actually needed a specific control for a specific data type, like provider mobile numbers.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Validate_access_control_against_your_org_chart_not_the_vendors_UI\"><\/span>2) Validate access control against your org chart, not the vendor&#8217;s UI<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Access control is where risk and day-to-day recruiting collide. Ask for a role model that matches how your team actually operates \u2014 sourcing, outreach, ops, leadership \u2014 and confirm least privilege.<\/p>\n<ul>\n<li><strong>Least privilege:<\/strong> users only access what they need for their role.<\/li>\n<li><strong>Admin boundaries:<\/strong> admin actions are distinct and reviewable.<\/li>\n<li><strong>Account lifecycle:<\/strong> clear provisioning and deprovisioning, especially with agency or recruiter turnover.<\/li>\n<\/ul>\n<p>Tighter permissions can slow teams down if roles are too rigid. A practical fix is a small set of roles mapped to real recruiting tasks, plus a documented escalation path for temporary access needs.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Confirm_encryption_scope_dont_assume_it\"><\/span>3) Confirm encryption scope; don&#8217;t assume it<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Skip the yes\/no question and ask specifics:<\/p>\n<ul>\n<li>Which data is encrypted in transit?<\/li>\n<li>Which data is encrypted at rest?<\/li>\n<li>Are there exceptions, and why?<\/li>\n<li>What evidence can be provided for our review?<\/li>\n<\/ul>\n<p>This requires manual verification on your end. If your policy sets specific key management or retention requirements, spell those out so the vendor can respond precisely instead of generically.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Treat_exports_and_permission_changes_as_the_highest-risk_events\"><\/span>4) Treat exports and permission changes as the highest-risk events<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In recruiting systems handling provider contact data, a data incident often looks like an over-broad export or a permission change nobody noticed. Require auditability for:<\/p>\n<ul>\n<li>Exports \u2014 who exported, what scope, when<\/li>\n<li>Permission changes \u2014 who granted access, to whom, when<\/li>\n<li>Admin actions \u2014 what changed, by whom, when<\/li>\n<li>Authentication events \u2014 logins, failed attempts<\/li>\n<\/ul>\n<p>Ask whether these events are logged, how long logs are retained, and how you&#8217;d obtain them during an investigation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Review_incident_response_at_a_%E2%80%9Chigh-level_but_real%E2%80%9D_layer\"><\/span>5) Review incident response at a &#8220;high-level but real&#8221; layer<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>You don&#8217;t need a full playbook to judge readiness \u2014 you need confirmation the basics are defined and owned:<\/p>\n<ul>\n<li><strong>Detection &amp; triage:<\/strong> how issues get identified and prioritized.<\/li>\n<li><strong>Containment:<\/strong> how access is restricted and blast radius reduced.<\/li>\n<li><strong>Communication:<\/strong> how customers are notified and what&#8217;s shared.<\/li>\n<li><strong>Remediation:<\/strong> how root cause is addressed and recurrence prevented.<\/li>\n<\/ul>\n<p>Procurement tip: confirm escalation contacts and the notification timeline your organization requires.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Ask_for_subprocessor_transparency\"><\/span>6) Ask for subprocessor transparency<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If your organization requires it, request a current subprocessor list, what each one does, and how changes get communicated. If it isn&#8217;t public, request it in writing; it should be <strong>available on request<\/strong>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Confirm_retention_deletion_expectations\"><\/span>7) Confirm retention &amp; deletion expectations<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Retention is where security meets policy. Ask for a summary covering:<\/p>\n<ul>\n<li>Recruiting data retention expectations<\/li>\n<li>Audit log retention expectations<\/li>\n<li>What deletion actually means in practice \u2014 removal from active systems, and how backups are handled<\/li>\n<\/ul>\n<p>If you need this for your vendor risk file, it&#8217;s <strong>available on request<\/strong>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"8_Tie_controls_to_recruiting_outcomes\"><\/span>8) Tie controls to recruiting outcomes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Security controls that slow recruiting down create shadow workflows \u2014 people find workarounds. The goal is governance that still supports day-to-day execution. For phone outreach, Heartbeat.ai can support features like ranked mobile numbers by answer probability, which makes it more important, not less, to restrict who can view and export contact data and keep export activity auditable.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Diagnostic_table\"><\/span>Diagnostic table<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Use this to run a fast internal review before sending a vendor questionnaire. It&#8217;s built for procurement files: clear asks, clear evidence, and a place to mark what&#8217;s in-product versus process versus requested.<\/p>\n<div class=\"table-scroll\" style=\"overflow:auto;-webkit-overflow-scrolling:touch;width:100%\">\n<table class=\"separated-content\">\n<thead>\n<tr>\n<th>Area<\/th>\n<th>What to ask<\/th>\n<th>Evidence to request<\/th>\n<th>Status (In-product \/ Process \/ Available on request)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Access control<\/td>\n<td>Provide role definitions and least-privilege approach; confirm admin boundaries.<\/td>\n<td>Role\/permission matrix; admin permission list<\/td>\n<td>In-product<\/td>\n<\/tr>\n<tr>\n<td>Encryption scope<\/td>\n<td>Confirm encryption in transit and at rest for our data flows; list exceptions.<\/td>\n<td>Encryption scope summary (available on request)<\/td>\n<td>Available on request<\/td>\n<\/tr>\n<tr>\n<td>Audit logs<\/td>\n<td>Do logs capture exports, permission changes, admin actions, and auth events?<\/td>\n<td>Sample audit log fields; retention statement<\/td>\n<td>In-product<\/td>\n<\/tr>\n<tr>\n<td>Incident response<\/td>\n<td>Share high-level incident response process and escalation contacts.<\/td>\n<td>Incident response overview (available on request)<\/td>\n<td>Process<\/td>\n<\/tr>\n<tr>\n<td>Subprocessors<\/td>\n<td>Provide current subprocessor list and change communication approach.<\/td>\n<td>Subprocessor list (available on request)<\/td>\n<td>Available on request<\/td>\n<\/tr>\n<tr>\n<td>Retention &amp; deletion<\/td>\n<td>Provide retention\/deletion summary for recruiting data and audit logs.<\/td>\n<td>Retention\/deletion summary (available on request)<\/td>\n<td>Available on request<\/td>\n<\/tr>\n<tr>\n<td>Customer responsibilities<\/td>\n<td>Confirm internal owner for offboarding, export policy, and acceptable use enforcement.<\/td>\n<td>Internal policy link or control owner name<\/td>\n<td>Process<\/td>\n<\/tr>\n<tr>\n<td>Transparency loop<\/td>\n<td>How do customers report issues and how are trust updates documented?<\/td>\n<td>Corrections intake description; change log pattern<\/td>\n<td>Process<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><strong>Suggested visual:<\/strong> maintain a simple change log table, public or customer-facing, with columns for Date, What changed, and Why it changed. Pair it with a persistent &#8220;report an issue&#8221; link that routes to a tracked intake.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Weighted_checklist\"><\/span>Weighted checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This scoring sheet helps you compare vendors quickly without turning the review into a long project. Adjust the weights to match your own policy.<\/p>\n<div class=\"table-scroll\" style=\"overflow:auto;-webkit-overflow-scrolling:touch;width:100%\">\n<table class=\"separated-content\">\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Weight<\/th>\n<th>Pass criteria<\/th>\n<th>What to file<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Access control<\/td>\n<td>30%<\/td>\n<td>Least privilege roles; admin boundaries; offboarding process<\/td>\n<td>Role matrix; admin controls summary<\/td>\n<\/tr>\n<tr>\n<td>Audit logs<\/td>\n<td>25%<\/td>\n<td>Logs for exports, permission changes, admin actions, auth events<\/td>\n<td>Sample fields; retention statement<\/td>\n<\/tr>\n<tr>\n<td>Encryption scope<\/td>\n<td>15%<\/td>\n<td>Encryption in transit\/at rest for scoped data flows; exceptions documented<\/td>\n<td>Encryption scope summary (available on request)<\/td>\n<\/tr>\n<tr>\n<td>Incident response<\/td>\n<td>10%<\/td>\n<td>Defined triage\/containment\/comms\/remediation; escalation contacts<\/td>\n<td>Incident response overview (available on request)<\/td>\n<\/tr>\n<tr>\n<td>Subprocessors<\/td>\n<td>10%<\/td>\n<td>Current list; change communication approach<\/td>\n<td>Subprocessor list (available on request)<\/td>\n<\/tr>\n<tr>\n<td>Retention &amp; deletion<\/td>\n<td>5%<\/td>\n<td>Retention\/deletion expectations documented for recruiting data and audit logs<\/td>\n<td>Retention\/deletion summary (available on request)<\/td>\n<\/tr>\n<tr>\n<td>Transparency workflow<\/td>\n<td>5%<\/td>\n<td>Corrections request workflow + visible change log pattern<\/td>\n<td>Intake description; change log pattern<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><strong>Scoring guidance:<\/strong> if access control or audit logs fail, pause rollout until the gaps are resolved or mitigated.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Outreach_templates\"><\/span>Outreach templates<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These templates are designed to get procurement-grade answers quickly, without back-and-forth.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Template_1_security_overview_request\"><\/span>Template 1: security overview request<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><strong>Subject:<\/strong> Security overview request for recruiting data<\/p>\n<p><strong>Body:<\/strong> Hi team \u2014 we&#8217;re reviewing Heartbeat.ai for recruiting use. Please share a security overview covering access control (roles\/least privilege), encryption scope (in transit\/at rest for our data flows), audit logs (exports\/admin\/auth events), incident response (high-level), subprocessors, and retention\/deletion expectations. If details aren&#8217;t public, note what&#8217;s available on request. Thanks.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Template_2_evidence_follow-up_on_exports_and_logging\"><\/span>Template 2: evidence follow-up on exports and logging<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><strong>Subject:<\/strong> Follow-up: export controls and audit logs<\/p>\n<p><strong>Body:<\/strong> Can you confirm whether audit logs capture (1) exports, (2) permission changes, (3) admin actions, and (4) authentication events? Please provide sample log fields and retention approach, and confirm how exports are permissioned and monitored.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Template_3_corrections_and_transparency_workflow\"><\/span>Template 3: corrections and transparency workflow<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><strong>Subject:<\/strong> Corrections request workflow + change log pattern<\/p>\n<p><strong>Body:<\/strong> For our trust review, please describe your corrections request workflow \u2014 how we report issues, how they&#8217;re triaged, and how we receive updates. Also share your change log pattern (date, what changed, why) and a &#8220;report an issue&#8221; intake link if available.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Common_pitfalls\"><\/span>Common pitfalls<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Vague answers instead of controls:<\/strong> if a statement doesn&#8217;t map to access control, encryption scope, audit logs, incident response, subprocessors, or retention, it isn&#8217;t procurement-ready.<\/li>\n<li><strong>Blurring in-product vs. process:<\/strong> this creates accidental over-claims and slows approvals. Keep the separation explicit.<\/li>\n<li><strong>Ignoring exports:<\/strong> exports are often the real data egress path in recruiting tools. If exports aren&#8217;t permissioned and logged, you don&#8217;t have governance \u2014 you have intentions.<\/li>\n<li><strong>Skipping shared responsibility:<\/strong> strong vendor controls won&#8217;t help if your own offboarding, export policy, and acceptable use enforcement are weak.<\/li>\n<li><strong>No transparency loop:<\/strong> without a corrections intake and change log pattern, issues linger and trust erodes across recruiting and IT.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"How_to_improve_results\"><\/span>How to improve results<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>To improve security outcomes without slowing recruiting, focus on the operational loop: permissions, logging, review, and transparency.<\/p>\n<ul>\n<li><strong>Design roles around tasks:<\/strong> sourcing vs. outreach vs. ops vs. leadership. Avoid default export rights for everyone.<\/li>\n<li><strong>Make audit logs usable:<\/strong> decide who can request logs, who reviews export activity, and how exceptions get handled.<\/li>\n<li><strong>Operationalize the transparency loop:<\/strong> build a corrections request workflow with a tracked intake \u2014 requester, issue type, affected record\/page, evidence link, desired correction, internal owner. Keep a visible change log with Date, What changed, and Why so procurement can see how updates get handled over time.<\/li>\n<li><strong>Keep artifacts ready:<\/strong> store the vendor&#8217;s overview, role matrix, incident response overview, and subprocessor list in your procurement system so renewals don&#8217;t restart from zero.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Legal_and_ethical_use\"><\/span>Legal and ethical use<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Heartbeat.ai is intended for legitimate recruiting operations. Your organization is responsible for complying with applicable privacy and data laws, honoring opt-out requests, and applying internal policies for acceptable use. Nothing on this page is legal advice, and we make no claims about your organization&#8217;s compliance posture.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Evidence_and_trust_notes\"><\/span>Evidence and trust notes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>How we evaluate and publish trust information: <a href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/\">Heartbeat.ai trust methodology<\/a>.<\/p>\n<p>We aim to keep this page aligned with helpful-content expectations: clear scope, operational detail, and no filler. Reference: <a href=\"https:\/\/developers.google.com\/search\/docs\/fundamentals\/creating-helpful-content\">Google Search Central: Creating helpful, reliable, people-first content<\/a>.<\/p>\n<p><strong>Procurement evidence pack (available on request):<\/strong><\/p>\n<ul>\n<li>Role\/permission matrix<\/li>\n<li>Encryption scope summary<\/li>\n<li>Audit log field list and retention statement<\/li>\n<li>Incident response overview and escalation contacts<\/li>\n<li>Subprocessor list<\/li>\n<li>Retention\/deletion summary<\/li>\n<li>Corrections intake description and change log pattern<\/li>\n<\/ul>\n<p>This page is updated as controls and documentation evolve. Request the latest evidence pack if you need a point-in-time snapshot for your file.<\/p>\n<p>If you need any of the above, contact us: <a href=\"http:\/\/heartbeat.ai\/resources\/company\/contact\/\">Heartbeat.ai contact page<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"FAQs\"><\/span>FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"What_should_a_security_overview_include_for_recruiting_data\"><\/span>What should a security overview include for recruiting data?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>At minimum: access control (least privilege), encryption scope for your data flows, audit logs for sensitive actions (especially exports and permission changes), incident response at a high level, subprocessors, and retention\/deletion expectations.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_evidence_should_procurement_request_from_Heartbeatai\"><\/span>What evidence should procurement request from Heartbeat.ai?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Request a role\/permission matrix, encryption scope summary, audit log coverage with sample fields and retention, incident response overview and escalation contacts, subprocessor list, retention\/deletion summary, and the corrections\/change log workflow. If details aren&#8217;t public, they&#8217;re available on request.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Why_are_exports_and_permission_changes_treated_as_high_risk\"><\/span>Why are exports and permission changes treated as high risk?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Because they&#8217;re common paths for unintended data exposure. If exports and permission changes aren&#8217;t permissioned and logged, it&#8217;s hard to investigate incidents or enforce internal policy.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_can_we_speed_up_vendor_risk_review_without_slowing_recruiting\"><\/span>How can we speed up vendor risk review without slowing recruiting?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use a short checklist: confirm least privilege roles, confirm export logging, confirm encryption scope for your data flows, confirm incident response escalation contacts, confirm subprocessors and retention expectations, and file the evidence for renewals.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_should_we_ask_for_to_complete_a_vendor_risk_questionnaire\"><\/span>What should we ask for to complete a vendor risk questionnaire?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Ask for a security overview, role matrix, encryption scope summary, audit log field list and retention, incident response overview, subprocessor list, retention\/deletion summary, and how corrections are reported and documented.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_does_%E2%80%9Cavailable_on_request%E2%80%9D_mean_in_procurement_terms\"><\/span>What does &#8220;available on request&#8221; mean in procurement terms?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It means the detail or artifact isn&#8217;t published publicly, but can be provided directly to your procurement\/IT team for review and filing \u2014 for example, a role matrix, encryption scope summary, or subprocessor list.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Next_steps\"><\/span>Next steps<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Run the weighted checklist internally to identify approval blockers.<\/li>\n<li>Send the outreach templates to collect procurement-grade evidence quickly.<\/li>\n<li>Start an evaluation: <a href=\"https:\/\/heartbeat.ai\/signup\">sign up for Heartbeat.ai<\/a>.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"About_the_Author\"><\/span><b>About the Author<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"http:\/\/heartbeat.ai\/resources\/author\/ben-argeband\"><span style=\"font-weight: 400;\">Ben Argeband<\/span><\/a><span style=\"font-weight: 400;\"> is the Founder and CEO of Swordfish.ai and Heartbeat.ai. With deep expertise in data and SaaS, he has built two successful platforms trusted by over 50,000 sales and recruitment professionals. Ben&#8217;s mission is to help teams find direct contact information for hard-to-reach professionals and decision-makers, providing the shortest route to their next win. Connect with Ben on <\/span><a href=\"https:\/\/www.linkedin.com\/in\/ben-m-argeband-2427a8a3\/\"><span style=\"font-weight: 400;\">LinkedIn<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><br \/>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"Article\",\"about\":[\"security\",\"access control\",\"encryption\",\"audit logs\",\"recruiting data\"],\"author\":{\"@type\":\"Person\",\"jobTitle\":\"Founder & CEO of Heartbeat.ai\",\"name\":\"Ben Argeband\"},\"dateModified\":\"2026-01-05\",\"datePublished\":\"2026-01-05\",\"headline\":\"Security overview for recruiting data\",\"isPartOf\":{\"@type\":\"WebSite\",\"name\":\"Heartbeat.ai\",\"url\":\"https:\/\/heartbeat.ai\/\"},\"mainEntityOfPage\":{\"@id\":\"https:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/\",\"@type\":\"WebPage\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Heartbeat.ai\",\"url\":\"https:\/\/heartbeat.ai\/\"}}<\/script><\/p>\n<p><script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"At minimum: access control (least privilege), encryption scope for your data flows, audit logs for sensitive actions (especially exports and permission changes), incident response (high-level), subprocessors, and retention\/deletion expectations.\"},\"name\":\"What should a security overview include for recruiting data?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Request a role\/permission matrix, encryption scope summary, audit log coverage (exports\/admin\/auth events) with sample fields and retention, incident response overview and escalation contacts, subprocessor list, retention\/deletion summary, and the corrections\/change log workflow. If details aren't public, they're available on request.\"},\"name\":\"What evidence should procurement request from Heartbeat.ai?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Because they're common paths for unintended data exposure. If exports and permission changes aren't permissioned and logged, it's hard to investigate incidents or enforce internal policy.\"},\"name\":\"Why are exports and permission changes treated as high risk?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Use a short checklist: confirm least privilege roles, confirm export logging, confirm encryption scope for your data flows, confirm incident response escalation contacts, confirm subprocessors and retention expectations, and file the evidence for renewals.\"},\"name\":\"How can we speed up vendor risk review without slowing recruiting?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Ask for a security overview, role matrix, encryption scope summary, audit log field list and retention, incident response overview, subprocessor list, retention\/deletion summary, and how corrections are reported and documented (change log pattern).\"},\"name\":\"What should we ask for to complete a vendor risk questionnaire?\"},{\"@type\":\"Question\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It means the detail or artifact isn't published publicly, but can be provided directly to your procurement\/IT team for review and filing (for example: a role matrix, encryption scope summary, or subprocessor list).\"},\"name\":\"What does \\\"available on request\\\" mean in procurement terms?\"}]}<\/script><\/p>","protected":false},"excerpt":{"rendered":"<p>A procurement-ready security overview for recruiting data: access control, encryption, audit logs, incident response, subprocessors, and retention.<\/p>","protected":false},"author":5,"featured_media":54166,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_custom_permalink":"trust-methodology\/security-overview","footnotes":""},"categories":[1],"tags":[],"class_list":["post-54167","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\r\n<title>Security Overview for Recruiting Data | Heartbeat.ai Trust<\/title>\r\n<meta name=\"description\" content=\"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and a corrections + change log workflow.\" \/>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_US\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"Security Overview for Recruiting Data | Heartbeat.ai Trust\" \/>\r\n<meta property=\"og:description\" content=\"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and a corrections + change log workflow.\" \/>\r\n<meta property=\"og:url\" content=\"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/\" \/>\r\n<meta property=\"og:site_name\" content=\"Heartbeat.ai\" \/>\r\n<meta property=\"article:published_time\" content=\"2026-02-01T18:30:21+00:00\" \/>\r\n<meta property=\"article:modified_time\" content=\"2026-08-31T13:46:00+00:00\" \/>\r\n<meta property=\"og:image\" content=\"https:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png\" \/>\r\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\r\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\r\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\r\n<meta name=\"author\" content=\"Ben Argeband\" \/>\r\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\r\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Argeband\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#article\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/\"},\"author\":{\"name\":\"Ben Argeband\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#\\\/schema\\\/person\\\/7b323ddce9b211907423482e2f9db173\"},\"headline\":\"Security Overview for Recruiting Data (Procurement + IT)\",\"datePublished\":\"2026-02-01T18:30:21+00:00\",\"dateModified\":\"2026-08-31T13:46:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/\"},\"wordCount\":2394,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#organization\"},\"image\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/security-overview-a81384b5.png\",\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/\",\"url\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/\",\"name\":\"Security Overview for Recruiting Data | Heartbeat.ai Trust\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#primaryimage\"},\"image\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/security-overview-a81384b5.png\",\"datePublished\":\"2026-02-01T18:30:21+00:00\",\"dateModified\":\"2026-08-31T13:46:00+00:00\",\"description\":\"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\\\/deletion, and a corrections + change log workflow.\",\"breadcrumb\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#primaryimage\",\"url\":\"http:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/security-overview-a81384b5.png\",\"contentUrl\":\"http:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/security-overview-a81384b5.png\",\"width\":1024,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/trust-methodology\\\/security-overview\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security Overview for Recruiting Data (Procurement + IT)\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#website\",\"url\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/\",\"name\":\"Heartbeat.ai\",\"description\":\"\",\"publisher\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#organization\",\"name\":\"Heartbeat.ai\",\"url\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Heartbeat.ai-logo.png\",\"contentUrl\":\"https:\\\/\\\/hc.heartbeat.ai\\\/wp-content\\\/uploads\\\/2021\\\/04\\\/Heartbeat.ai-logo.png\",\"width\":704,\"height\":126,\"caption\":\"Heartbeat.ai\"},\"image\":{\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/#\\\/schema\\\/person\\\/7b323ddce9b211907423482e2f9db173\",\"name\":\"Ben Argeband\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g\",\"caption\":\"Ben Argeband\"},\"url\":\"http:\\\/\\\/heartbeat.ai\\\/resources\\\/author\\\/ben-argeband\\\/\"}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security Overview for Recruiting Data | Heartbeat.ai Trust","description":"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and a corrections + change log workflow.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/","og_locale":"en_US","og_type":"article","og_title":"Security Overview for Recruiting Data | Heartbeat.ai Trust","og_description":"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and a corrections + change log workflow.","og_url":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/","og_site_name":"Heartbeat.ai","article_published_time":"2026-02-01T18:30:21+00:00","article_modified_time":"2026-08-31T13:46:00+00:00","og_image":[{"width":1024,"height":1024,"url":"https:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png","type":"image\/png"}],"author":"Ben Argeband","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ben Argeband","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#article","isPartOf":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/"},"author":{"name":"Ben Argeband","@id":"http:\/\/heartbeat.ai\/resources\/#\/schema\/person\/7b323ddce9b211907423482e2f9db173"},"headline":"Security Overview for Recruiting Data (Procurement + IT)","datePublished":"2026-02-01T18:30:21+00:00","dateModified":"2026-08-31T13:46:00+00:00","mainEntityOfPage":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/"},"wordCount":2394,"commentCount":0,"publisher":{"@id":"http:\/\/heartbeat.ai\/resources\/#organization"},"image":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#primaryimage"},"thumbnailUrl":"http:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png","articleSection":["News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/","url":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/","name":"Security Overview for Recruiting Data | Heartbeat.ai Trust","isPartOf":{"@id":"http:\/\/heartbeat.ai\/resources\/#website"},"primaryImageOfPage":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#primaryimage"},"image":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#primaryimage"},"thumbnailUrl":"http:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png","datePublished":"2026-02-01T18:30:21+00:00","dateModified":"2026-08-31T13:46:00+00:00","description":"Procurement-ready security overview for recruiting data: access control, encryption scope, audit logs, incident response, subprocessors, retention\/deletion, and a corrections + change log workflow.","breadcrumb":{"@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#primaryimage","url":"http:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png","contentUrl":"http:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2026\/02\/security-overview-a81384b5.png","width":1024,"height":1024},{"@type":"BreadcrumbList","@id":"http:\/\/heartbeat.ai\/resources\/trust-methodology\/security-overview\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/heartbeat.ai\/resources\/"},{"@type":"ListItem","position":2,"name":"Security Overview for Recruiting Data (Procurement + IT)"}]},{"@type":"WebSite","@id":"http:\/\/heartbeat.ai\/resources\/#website","url":"http:\/\/heartbeat.ai\/resources\/","name":"Heartbeat.ai","description":"","publisher":{"@id":"http:\/\/heartbeat.ai\/resources\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/heartbeat.ai\/resources\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"http:\/\/heartbeat.ai\/resources\/#organization","name":"Heartbeat.ai","url":"http:\/\/heartbeat.ai\/resources\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/heartbeat.ai\/resources\/#\/schema\/logo\/image\/","url":"https:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2021\/04\/Heartbeat.ai-logo.png","contentUrl":"https:\/\/hc.heartbeat.ai\/wp-content\/uploads\/2021\/04\/Heartbeat.ai-logo.png","width":704,"height":126,"caption":"Heartbeat.ai"},"image":{"@id":"http:\/\/heartbeat.ai\/resources\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"http:\/\/heartbeat.ai\/resources\/#\/schema\/person\/7b323ddce9b211907423482e2f9db173","name":"Ben Argeband","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9cdd6acf262740ced0b6a1c76378e93640df32a98d2f4d29507f31fbce6817e7?s=96&d=mm&r=g","caption":"Ben Argeband"},"url":"http:\/\/heartbeat.ai\/resources\/author\/ben-argeband\/"}]}},"_links":{"self":[{"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/posts\/54167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/comments?post=54167"}],"version-history":[{"count":3,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/posts\/54167\/revisions"}],"predecessor-version":[{"id":66188,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/posts\/54167\/revisions\/66188"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/media\/54166"}],"wp:attachment":[{"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/media?parent=54167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/categories?post=54167"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/heartbeat.ai\/resources\/wp-json\/wp\/v2\/tags?post=54167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}