Security
Last updated 5 October 2026
Two things on RightSource are worth protecting: the roles you are hiring for, which are commercially sensitive, and candidate records, which are personal. Here is how each is handled.
Masked by default
Candidate names, employers, dates and contact details are hidden until someone deliberately reveals them. This is the default for every viewer, including you, and it is the single most important control we have: the common way recruiting data leaks is that everyone can see everything by accident.
Revealing a candidate is a recorded action tied to an account. Signed-out visitors cannot reveal anyone at all.
Sign-in
- Authentication runs through AWS Cognito, with single sign-on available for organisations that want it.
- Session cookies are HTTP-only, so page scripts cannot read them.
- We never see or store your identity-provider password.
Shared shortlists
A share link is a capability: whoever holds it can open the shortlist. We treat that seriously.
- Shared pages carry a noindex directive and are excluded in robots.txt, so a leaked link does not become a search result.
- Every open is counted, so you can see whether a link travelled further than you intended.
- Links can be given an expiry date, and revoked.
- Contact details stay masked on a shared page unless the recipient has their own access.
Infrastructure
RightSource runs on Amazon Web Services. Résumés are held in private object storage, never in a public bucket. The AI models that read job descriptions run in Amazon Bedrock, which does not retain or train on the text sent to it.
Searching without an account
A signed-out visitor is identified only by a random token in an HTTP-only cookie. It carries no personal information, it expires after 30 days, and the searches behind it are deleted on the same schedule unless an account claims them. See Privacy for the detail.
Reporting a problem
If you believe you have found a security issue, email hello@rightsource.ai with enough detail to reproduce it. Please give us a reasonable chance to fix it before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith.