Infrastructure
Hosted in Australia, encrypted throughout
Hosted in Australia
Floats runs on AWS in Sydney. Your database, files (such as CVs, photos and attachments) and backups are all held in Australia.
Encrypted at rest
All Floats data is encrypted at rest, including the database, file storage and backups.
Encrypted in transit
All traffic to and from Floats, including the app, API and integrations, is encrypted using TLS.
Backups for recovery only
Encrypted backups are taken automatically and kept for disaster recovery. They aren't used for anything else.
Application security
Controls built into Floats
Access by role and team
People only see the data their role and team allow. Permissions are checked on every request, so users can only reach their own organisation's data.
Authenticated access
Every request to the app and the API must be authenticated, and API keys are kept separate from app sign-ins.
Kept up to date
We apply security patches and dependency updates on an ongoing basis, and release changes through an automated pipeline.
Abuse protection
Rate limits protect our endpoints, and automated bot filtering keeps engagement tracking accurate.
AI and candidate data
How AI handles candidate information
How AI is used
Floats uses frontier models to read uploaded CVs and to write candidate summaries and presentation copy. To do this, the contents of a CV are sent to our AI provider for processing.
Not used for training
Candidate data is only used to provide Floats to you. It isn't used to train or improve any AI model, whether ours or a provider's.
Anonymise before you share
Recruiters can remove or mask a candidate's identifying details before sharing a profile with a client. This controls what your client sees when you share a float or submission.
People make the decisions
AI summaries support recruiter judgement. Floats doesn't make automated hiring decisions, and every decision about a candidate stays with you.
Operations
How we run Floats
Limited production access
Only staff whose role requires it can access production systems. Access is least-privilege and removed when it's no longer needed, and everyone with access to customer data is bound by confidentiality obligations.
Multi-factor authentication
Multi-factor authentication protects our hosting, cloud infrastructure and source code.
Real data stays in production
Development and staging environments don't hold real candidate data.
Continuous monitoring
We monitor errors and performance continuously, with alerts for anything unusual.
Governance
Agreements and policies
- Data Processing Agreement
- Our Data Processing Agreement sets out our obligations as a data processor, including UK GDPR requirements, our sub-processors and international data transfers.
- Sub-processors
- We publish the providers that process data on our behalf. See the full list of sub-processors.
- Data deletion
- We have a documented process for deleting data on request and when an account closes, including data held by sub-processors and in backups.
- Security questionnaires
- We're happy to complete your security and data protection questionnaires, and can send our full security overview for your due diligence.
Contact
Security and privacy enquiries
- Security enquiries and vulnerability reports
- [email protected]
- Privacy and data protection
- [email protected] ยท Privacy Policy
- Company
- SOLA SYSTEM PTY LTD (ABN 55 689 449 830), trading as Floats, based in Victoria, Australia.
Using Floats with Claude? See what the connector reads and keeps.