How does VOUCHIR ensure compliance with the DPDP Act 2023 and EU GDPR?

VOUCHIR operates strictly as a Data Processor under India's DPDP Act 2023 and EU GDPR Article 28. Candidate personal data is handled via client-side transient intake with zero third-party tracking cookies, cryptographic token masking (AES-128-CBC / HMAC-SHA256), automated 90-day retention policies, and single-tenant VPC deployment options.

Does VOUCHIR retain candidate PII on multitenant public endpoints?

No. VOUCHIR supports single-tenant VPC private cloud isolation where the containerized stack runs entirely within the customer VPC (AWS, Azure, or GCP). Resumes and applicant data are cryptographically attributed and routed directly to the corporate ATS with zero multitenant data leakage.

Enterprise Security & Architecture

Interactive 4-Stage Pipeline Topology

Click any stage to inspect communication protocols, TLS profiles, and security isolation.

Closed-Loop Attribution MeshBlueprint PDF

Technical Architecture Specification

Stage 1: Enterprise HRIS / Requisition Feeds

Workday, Greenhouse, Lever, SAP SuccessFactors

Protocol & TransportInbound Webhook / Read-Only REST Polling (TLS 1.3)

Security Isolation ProfileZero Write Access Risk (Least-Privilege Scopes)

Read-only REST/JSON feed sync with scheduled 15-minute polling or real-time event webhooks.
Scoped OAuth 2.0 access credentials with zero capability to modify or write to employee master records.
Automatic sync of job status, title, department, hiring manager, and referral bonus bounty.

Single-Tenant VPC Boundary

Private Cloud Isolation Architecture

VOUCHIR runs as a containerized stack entirely within your organization's Virtual Private Cloud (AWS VPC, Azure VNet, or Google Cloud VPC). Zero candidate PII traverses multitenant public endpoints.

Zero Data Retention

Resumes routed directly into your ATS; no secondary storage.

Isolated Egress

Outbound calls restricted to enterprise-whitelisted webhook targets.

Tier 1 Enterprise Security

Dedicated Private Cloud VPC

Deployed entirely inside your organization's AWS EKS, Azure AKS, or Google Cloud GKE environment. Tailored for banks, GCCs, and defense enterprises.

Single-tenant container stack inside your corporate VPC perimeter
Zero candidate resume bytes ever traverse external shared infrastructure
IAM role authentication & AWS KMS / HashiCorp Vault secrets management
Encrypted Syslog & SIEM audit streaming via mutual TLS (mTLS)
99.99% Enterprise uptime SLA with dedicated operational pod

Compliant with SOC2 Type II, ISO 27001, DPDP Act 2023, and HIPAA

Rapid Zero-Friction Setup

Cloud-Managed Enterprise SaaS

Turnkey distribution and attribution layer with zero cloud infrastructure to manage. Evaluated and approved by fast-scaling mid-market enterprises.

Instantaneous 15-minute onboarding via public career feed ingestion
Transient applicant parsing; zero multi-tenant persistent resume storage
Pre-built Slack App and Microsoft Teams bot directory integration
Continuous automated vulnerability scanning & end-to-end encryption
99.95% High-Availability uptime SLA with zero maintenance windows

Zero IT provisioning required on Day 1

Enterprise Deployment Specification

Non-Root Container Manifest (Docker Compose)

Pre-configured with UID 1001 non-root security context, read-only rootfs, and capability dropping.

Standard Deployment Stack Specification: Docker Compose & Kubernetes Helm Charts

Click the button above to expand and review complete non-root manifest definitions, environment variables, healthchecks, and volume mounts.

Institutional Trust Perimeter

DPDP Act 2023 & GDPR Enterprise Compliance Architecture

Engineered for strict infosec, zero-retention candidate intake, cryptographic token masking, and private VPC deployment.

AES-128-CBC with HMAC-SHA256 Encryption

Python Fernet Standard & Tamper-Proof Hashes

Every referral link generates a cryptographically signed HMAC-SHA256 token (?ref=uuid) using AES-128-CBC with HMAC-SHA256 authenticated encryption (Python Fernet standard). The token binds applicant touchpoints directly to internal employee IDs without ever exposing cleartext employee emails on public social networks.

Tamper-evident HMAC signature validation on every application request
Prevents employee email harvesting from public LinkedIn shares

DPDP Act 2023 & GDPR DPA Compliance

Data Processor Role & Statutory Safeguards

Engineered from the ground up for India’s Digital Personal Data Protection Act (DPDP 2023) and EU GDPR Art. 28. VOUCHIR operates strictly as a Data Processor on behalf of the Employer (Data Fiduciary / Controller). Standard Data Processing Addendum (DPA) includes mandatory candidate consent checkboxes, automated 90-day retention policies, and cryptographic anonymization upon applicant erasure requests.

Statutory consent checkboxes verified before resume processing
Client-side transient intake with zero third-party tracking cookies

Download CISO Security & DPA Addendum (PDF) →

Non-Root Container Enforcement

USER appuser (UID 1001), Readonly Rootfs

Container engines execute strictly under unprivileged service users (USER appuser:appuser, UID 1001). Privileges are permanently dropped with read-only root filesystems and write access restricted strictly to in-memory tmpfs scratch buffers.

security_opt: no-new-privileges:true enabled
Zero host-level root escape vectors

Zero Multi-Tenant Data Leakage

Row-Level Security & Tenant Isolation

PostgreSQL Row-Level Security (RLS) guarantees tenant boundaries at the database engine kernel level. For high-assurance banking and GCC tiers, full physical database segregation is provisioned inside your enterprise VPC boundary.

Strict Row-Level Security (RLS) on all candidate and referral tables
Private VPC isolation option with dedicated PostgreSQL container

VOUCHIR Enterprise Security & Compliance

Enterprise Security Architecture

Designed for Rigorous CISO & Procurement Audits

Every VOUCHIR integration is accompanied by full bilateral non-disclosure agreements, third-party penetration test reports, SOC2 Type II certifications, and continuous TLS 1.3 encrypted audit log streaming.

Request Full Security Whitepaper & SOC2 Report

Deterministic REST Integration Mesh

Integration API Specs & Webhook Contracts

Standard OpenAPI 3.0 / TLS 1.3 Endpoints

POST/api/v1/jobs/ingest

Invoked by your corporate ATS (Workday, Greenhouse, Lever, or custom middleware) when an approved requisition opens. Synchronously validates the HMAC signature and queues role-matching syndication to employees.

Request Headers & JSON Payload

POST /api/v1/jobs/ingest HTTP/1.1
Host: api.getvouchir.com
Authorization: Bearer vchr_live_sec_88492048f029
Content-Type: application/json

{
  "ats_provider": "workday",
  "requisition_id": "REQ-1001-ENG",
  "title": "Staff Cloud Security Engineer",
  "department": "Infrastructure Security",
  "location": "San Francisco, CA / Remote",
  "hiring_manager": "Sarah Kim",
  "referral_bonus_amount": 10000.00,
  "currency": "USD",
  "webhook_signature": "sha256:d8a2fe7890bc41ef9001bfa288c"
}

Response: 201 Created

HTTP/1.1 201 Created
Content-Type: application/json

{
  "status": "ingested",
  "job_id": "c4218b81-293a-42dd-8bdb-47f2769b5d5b",
  "requisition_id": "REQ-1001-ENG",
  "syndication_queue_id": "sq_991823_slack",
  "eligible_advocates_count": 24,
  "timestamp": "2026-09-28T01:30:00Z"
}

POST/api/v1/candidates/intake

Captures candidate application submissions from tracked referral links. Verifies DPDP Act 2023 consent, hashes resume raw bytes, locks attribution permanently to the referring colleague, and triggers the automated digital voucher certificate.