01
Read this alongside your deployment
This page explains the product's documented security model, not an independent audit of a live deployment. A local device, an OptiTalent-hosted workspace and an independently operated service have different owners and controls.
The local website preview does not connect its forms to the recruiting backend. Its sample shortlist and status links demonstrate layout only; they are not secure sharing or authentication implementations.
02
Local workspace
The desktop model keeps its local workspace on the user's device. That does not make every feature offline: networked AI, imports, exports, synchronisation or sharing can cross a separate data boundary.
Protect the device and its backups. Review the actual release's storage, key handling and recovery behaviour before using sensitive records. Local storage alone is not evidence of encryption or a guarantee that an administrator or other device user cannot access data.
03
Hosted access and file handling
The documented hosted design checks workspace ownership and user permissions at its data-access boundaries. Private application files follow a quarantine and scan process before being accepted into the recruiting workflow. These checks address different risks: permission to access a file does not establish that the file is safe.
Effective protections depend on the deployed release and configuration. This page does not claim that a healthy server, a passed test or a visible login screen proves every production control is operating correctly.
04
AI is a separate disclosure
An AI feature may send selected evidence and role context to a configured provider. Review what is being sent, which provider receives it, and the provider's retention and training terms. Bringing your own key changes the connection and billing relationship; it does not eliminate data-processing risk.
Never paste API keys, passwords or private candidate files into a marketing form. AI outputs should be checked against their sources before a recruiter acts on them.
05
Shortlist sharing
The documented external Pack design separates a recipient's approved snapshot from the private source record and uses expiring, revocable access. Internal notes and source files are not interchangeable with material approved for a client.
Check the contents and recipient before sharing. Access expiry or revocation cannot recall a screenshot, downloaded copy or onward disclosure. It also does not erase the underlying recruiting record.
06
Independent deployments and assurance
A self-hosted operator is responsible for its infrastructure, accounts, keys, network exposure, updates, backups and incident response. An OptiTalent product description cannot certify a separately operated installation.
We do not claim SOC 2 or ISO 27001 certification on this page, universal data residency, zero risk, or uninterrupted service. Request release-specific evidence for controls that matter to your organisation rather than assuming all deployment options provide identical protection.
07
Reporting a security concern
Do not test a suspected issue against another person's records or continue accessing data you are not authorised to see. Preserve a minimal description of the affected page, approximate time and safe reproduction steps. Exclude passwords, access tokens and candidate documents.
A monitored security-reporting address must be confirmed before production publication. Until it is shown here, do not send credentials or candidate documents through the general contact form. This page does not authorise intrusive testing or offer a bug-bounty or response-time commitment.