Security & Data Handling Summary
Last updated: October 09, 2026
A plain-language overview of how Siftral handles your firm’s data, written for recruiting and technical leaders, not just engineers. This overview complements our Privacy Policy, which covers what data we collect and how it’s used. If anything here raises a question, ask us directly.
The short version: Siftral processes candidate and job data to screen, score, and draft outreach, then automatically and permanently deletes it within 30 days — a bounded, self-purging window, not a permanent, ever-growing candidate repository the way an ATS is. We don’t train AI models on your data, and connections between your browser, our servers and our AI provider are encrypted with HTTPS/TLS.
How Your Data Is Processed
- Job descriptions and candidate profiles are sent to Siftral while a screening run is in progress. The data passes through our pipeline, gets scored and summarized, and the result is handed back to your dashboard.
- Siftral does retain candidate and job data on our systems, for up to 30 days, to support screening history and review inside your dashboard, but this is a bounded, self-purging window, not a permanent, ever-growing repository. Your Applicant Tracking System remains the single source of truth wherever one is in use; Siftral is a processing layer on top of it, not a second, permanent copy of your data. Today, candidate and job data reach Siftral through direct upload (CSV, PDF, or Word) or a CSV export from whatever system you already use. Direct Bullhorn integration is in active development and is not yet connected to any live account.
- In the browser, approved candidates and generated drafts are held in your browser's session storage, a temporary holding area that clears automatically when you close the browser tab. Nothing is left behind on your machine.
Retention Policy
- Candidate and job data is retained on our systems for up to 30 days to support screening history and review inside your dashboard, then automatically and permanently deleted.
- Session data in your browser (approved candidates, draft outreach, submittals) clears the moment you close the browser, there is no server-side copy sitting behind it beyond the 30-day window above.
- If your firm has stricter retention requirements, reach out and we'll accommodate them for your account.
- The deletion log (when a run was deleted, by whom, and the job title) is kept for record-keeping and is not removed in the 30-day cleanup. It contains no candidate documents or contact details.
Infrastructure
- Siftral runs on established cloud providers for hosting, database storage and workflow processing. Our database is hosted in the United States (AWS US East, N. Virginia). If you need your data held in a specific region, ask us and we will tell you what is possible.
- Connections from your browser to our servers, and from our servers to the AI provider that performs the screening, use HTTPS/TLS encryption.
- Each firm's data is separated at the database level, so users at one firm cannot read another firm's screening runs or history.
Authentication & Access
- Recruiter access to the Siftral dashboard is protected by an industry-standard authentication system. There is no public sign-up, every account is provisioned individually, so only authorized staff at your firm can ever log in.
- Unauthenticated visitors are redirected away from any screening data, there is no way to view a dashboard without a valid, provisioned login.
- Permanently deleting a screening run requires a signed-in session and is recorded in an audit log. Deleted runs are held for 7 days so they can be restored, unless you choose to delete them permanently straight away.
AI Usage, No Training on Your Data
- Siftral uses a third-party AI/large-language-model provider to read job descriptions, score candidates, and draft outreach and submittal copy.
- Your data is never used to train any AI model, not Siftral's, not our AI provider's, not anyone else's. Each screening run is a one-time request: data in, result out, nothing retained by the model provider for training.
Built Around Data-Protection Principles
- A bounded retention window, no training of AI models on your data, firm-level data separation and individually provisioned accounts reflect principles such as data minimization and purpose limitation. We have not yet certified compliance with GDPR or other regional frameworks. If your firm needs that confirmed, raise it with us directly.
- Your Applicant Tracking System, once integrated, remains the system of record for candidate data at all times, Siftral never becomes a second, ungoverned copy of your data.
Questions about anything above, or want to report a security concern? Reach out to us at azfar@siftral.io, we’re happy to walk through specifics for your firm’s compliance needs.