VOUCHIR Technologies
VENTERPRISE INTEGRATION & SECURITY

Built for Enterprise. Designed for Trust.

Designed to support responsible hiring and your organization's security program.

System ArchitectureDeployment Options
Security & Compliance
Integration APIs

COMPLIANCE SUPPORT

Control areas that help teams meet applicable privacy, security, and contractual obligations.

  • Explain what personal data is used and why.
  • Collect only what the stated purpose needs.
  • Support access, correction, and deletion requests where applicable.
  • Set retention periods and document processor responsibilities.

DPDP Act 2023 & GDPR Art. 28 Alignment:

VOUCHIR operates strictly as a Data Processor on behalf of the Employer (Data Fiduciary / Controller). Statutory candidate consent checkboxes are verified prior to resume ingestion, with transient intake and zero third-party advertising cookies.

Requirements vary by applicable law, customer role, data, and deployment.

VOUCHIR SECURITY PROFILE

VOUCHIR security profile

A clear view of the controls built into the product and the evidence each deployment must provide.

Enterprise Cloud VPC

Single-Tenant Boundary

TLS 1.3 Active

Fernet Crypt

HMAC-SHA256

Non-Root UID

appuser:1001

Kernel RLS

Zero Leakage

SOC 2 Type II Aligned DPDP 2023 Statutory
Identity & role controls
Validation required
Data protection & encryption
Validation required
Audit and operational monitoring
Validation required
Secure development & file handling
Validation required

Security status is established through technical review and deployment evidence—not a headline score.

System Architecture Powered by VOUCHIR Integration Engine
SOCIAL SYNDICATION & REPUTATIONAL INTEGRITY

Enterprise Social Governance & Compliance

Protecting corporate brand reputation and employee autonomy across external social networks through human-in-the-loop authorization, strict least-privilege OAuth scopes, and cryptographic payload verification.

Zero Unconsented Social Posting

Human-in-the-Loop Slack & Teams Gateway

Completely eliminates automated bot-posting and spam risks. Content syndication strictly requires explicit, interactive authorization by the employee within their enterprise Slack or Teams workspace before any broadcast occurs.

  • Interactive workplace approval cards
  • Explicit member-initiated consent only
  • Full personal profile privacy control

Least-Privilege OAuth 2.0 PKCE Scopes

Strict Scoping & Zero Private Data Access

OAuth 2.0 authorization requests only minimal required permissions (r_liteprofile, w_member_social). Zero access is requested or granted for private DMs, 1st-degree connection graphs, or profile editing.

  • Proof Key for Code Exchange (RFC 7636)
  • Zero access to member private messages
  • Instant 1-click token revocation

Webhook Payload Integrity (HMAC-SHA256)

Cryptographic Signature Verification

Inbound CMS feeds (Ghost, Strapi, WordPress, Contentful) and outbound workplace triggers require valid SHA256 HMAC cryptographic signatures passed via X-Vouchir-Signature, stopping spoofing and replay attacks.

  • Timing-safe HMAC-SHA256 validation
  • 5-minute timestamp anti-replay window
  • Rotatable enterprise webhook secrets
Institutional Trust Perimeter

Zero-Trust Security & Compliance Matrix

Engineered for strict infosec and DPDP statutory standards.

AES-128-CBC with HMAC-SHA256 Encryption

Python Fernet Standard & Tamper-Proof Hashes

Every referral link generates a cryptographically signed HMAC-SHA256 token (?ref=uuid) using AES-128-CBC authenticated encryption. The token binds applicant touchpoints directly to internal employee IDs without ever exposing cleartext employee emails on public social networks.

  • Tamper-evident HMAC signature validation on every application request
  • Prevents employee email harvesting from public LinkedIn shares

DPDP Act 2023 & GDPR DPA Compliance

Data Processor Role & Statutory Safeguards

Engineered from the ground up for India’s Digital Personal Data Protection Act (DPDP 2023) and EU GDPR Art. 28. VOUCHIR operates strictly as a Data Processor on behalf of the Employer (Data Fiduciary / Controller). Standard Data Processing Addendum (DPA) includes mandatory candidate consent checkboxes, automated 90-day retention policies, and cryptographic anonymization upon applicant erasure requests.

  • Statutory consent checkboxes verified before resume processing
  • Client-side transient intake with zero third-party tracking cookies
Download CISO Security & DPA Addendum (PDF) →

Non-Root Container Enforcement

USER appuser (UID 1001), Readonly Rootfs

Container engines execute strictly under unprivileged service users (USER appuser:appuser, UID 1001). Privileges are permanently dropped with read-only root filesystems and write access restricted strictly to in-memory tmpfs scratch buffers.

  • security_opt: no-new-privileges:true enabled
  • Zero host-level root escape vectors

Zero Multi-Tenant Data Leakage

Row-Level Security & Tenant Isolation

PostgreSQL Row-Level Security (RLS) guarantees tenant boundaries at the database engine kernel level. For high-assurance banking and GCC tiers, full physical database segregation is provisioned inside your enterprise VPC boundary.

  • Strict Row-Level Security (RLS) on all candidate and referral tables
  • Private VPC isolation option with dedicated PostgreSQL container

Ready to modernize your talent referral infrastructure?

Connect your existing ATS in under 15 minutes. No rip-and-replace, single-tenant private cloud isolation.

Launch Platform Sandbox →See Architecture