REQeV

Security and Privacy at REQeV

Effective date: September 17, 2026

REQeV is operated by ECDG, Inc., a California corporation, doing business as REQeV (“REQeV”, “we”, “us”). Recruiting firms and employers use REQeV ATS, REQeV Sourcing, REQeV Mission Control and our related APIs, integrations, browser extensions and AI features (the “Services”) to manage sensitive candidate and contact information.

This page gives customers, prospects and their security teams an overview of how we protect that information. It is provided for information only. Our binding commitments are set out in our Master Subscription Agreement, Data Processing Addendum and any applicable Order Form, which control if there is a conflict with this page.

1. Our Approach

We design security into the Services from the start rather than adding it later. Our program is built on a few principles: collect and keep only the data we need, give people only the access they need, rely on well-established managed infrastructure, and keep customers informed.

Customers are the controllers of the candidate and contact data they place in the Services (“Customer Data”), and REQeV processes that data on their behalf as a processor or service provider. We treat Customer Data as confidential and use it only to provide and support the Services and as otherwise permitted by our agreements.

We review and improve our security practices over time as the Services, threats and industry standards change. The measures described here may evolve, but we will not materially reduce the overall level of protection for Customer Data during a customer’s subscription term.

2. Infrastructure

The Services run on established cloud providers rather than on servers we operate ourselves.

  • Application hosting: Vercel, Inc. hosts the REQeV web applications and APIs in the United States.
  • Database: Supabase, Inc. provides our managed PostgreSQL database in the United States, running on Amazon Web Services (AWS) infrastructure.
  • Payments: Stripe, Inc. processes subscription and credit pack payments.

These providers operate or use professionally managed data centers with physical security, environmental controls and redundancy. Our infrastructure providers publish their own compliance reports and certifications, which are available from those providers under their own terms. Those certifications belong to the providers; REQeV does not claim them for itself.

A current list of the service providers that process Customer Data, and where they process it, is available on our Subprocessors page.

3. Encryption

In transit

Connections to reqev.com, app.reqev.com and our APIs are encrypted using TLS 1.2 or higher. Unencrypted HTTP requests are redirected to HTTPS. Connections between our application and our database provider are also encrypted in transit.

At rest

Customer Data stored in our database and file storage is encrypted at rest by our database and storage provider using industry-standard AES-256 encryption. Encryption keys are managed by the provider’s key management systems.

4. Payments

Payments for subscriptions and credit packs are processed by Stripe. Card details are entered into Stripe-hosted or Stripe-provided payment forms and sent directly to Stripe.

REQeV does not store full payment card numbers on its systems. We may retain limited payment information that Stripe makes available to us, such as card brand, last four digits and expiration date, to manage billing.

Stripe states that it is certified as a PCI DSS Level 1 Service Provider, the highest level of certification under the Payment Card Industry Data Security Standard.

5. Application Security

We use several layers of controls to protect the Services and the data within them.

  • Tenant isolation: Customer Data is logically separated by customer account, and application and database access controls are designed to prevent one customer from accessing another customer’s data.
  • Role-based access: customers can assign roles to their users to control what each user can view and do within their account.
  • Secure development: code changes go through review before release, and we follow secure coding practices designed to address common web application risks such as injection, cross-site scripting and broken access control.
  • Dependency management: we monitor and update third-party libraries and frameworks to address known vulnerabilities.
  • Service-to-service authentication: tool-to-hub calls use per-tool shared secrets. Outbound credit-grant commands from the hub are HMAC-signed so recipients can verify their source and integrity.
  • Secrets management: API keys, credentials and other secrets are stored in managed environment variables provided by our hosting platform, not in source code.
  • Session security: user sessions are managed with secure, time-limited authentication tokens.

6. Access Control

Access to production systems and Customer Data within REQeV is limited to personnel who need it to operate, support or secure the Services.

  • Least privilege: personnel receive the minimum access needed for their role, and access is removed promptly when it is no longer needed, including on departure.
  • Multi-factor authentication: MFA is required for administrative accounts and for accounts with access to our infrastructure providers.
  • Support access: REQeV personnel access a customer’s account data only as needed to provide support, investigate issues, maintain the Services or comply with law.

7. Monitoring and Logging

We use logging and monitoring provided by our hosting and database providers to track application errors, availability and relevant security events. Logs help us detect unusual activity, investigate issues and support incident response.

Access to logs is restricted to authorized personnel, and logs are retained for a limited period consistent with operational and security needs. We aim to avoid recording sensitive Customer Data in logs where practical.

Where a signed Order Form includes our SLA, we monitor availability against the commitments in our Service Level Agreement.

8. Backups and Recovery

Our managed database provider performs automated backups of production data. Backups are retained for a limited rolling period and are encrypted and stored by the provider.

We maintain procedures to restore the Services and data in the event of a failure, using the backups available from our provider. Specific recovery time and recovery point commitments apply only if agreed in writing.

When a subscription ends, customers can request return or deletion of their data under the DPA. Unless earlier deletion is requested, data remains available during the applicable export window and is then deleted without undue delay, subject to legally required retention. Backup copies are put beyond use pending overwrite under the applicable documented retention schedule, which customers may ask us to explain. Legal deadlines for privacy requests continue to apply.

9. Incident Response

We maintain a process for identifying, investigating, containing and resolving security incidents, including assigning responsibility, preserving evidence and conducting a review after an incident.

If we become aware of a security breach affecting Customer Data, we will notify affected customers without undue delay and no later than 72 hours after becoming aware of it, as described in our Data Processing Addendum. Our notice will include the information reasonably available to us to help customers assess the incident and meet their own obligations, and we will provide updates as we learn more.

To report a suspected security incident involving the Services, email support@reqev.com.

10. Vendor Management

We rely on a limited number of carefully selected service providers. Before engaging a provider that will process Customer Data, we review its security and privacy practices in light of the data involved.

Providers that process Customer Data are bound by written agreements that include confidentiality, security and data protection obligations appropriate to their services. We give customers 30 days’ notice of changes to the providers that process Customer Data, as described in our Data Processing Addendum.

Our current providers are listed on our Subprocessors page.

11. AI Features and Customer Data

Some Services include AI features, such as assistance with drafting, summarizing or matching. These features use third-party AI providers and models running on REQeV-controlled servers. Details are on our Subprocessors page.

  • We do not use Customer Data to train generalized AI models that are made available to other customers or third parties.
  • Our AI providers are contractually restricted from using Customer Data submitted through the Services to train their own models, and may use it only to provide their services to REQeV.
  • Customer Data sent to AI providers is limited to what is needed to perform the requested feature.
  • AI output can be inaccurate, and customers remain responsible for reviewing it before relying on it, especially for decisions about candidates.

12. Privacy Program

Security is one part of our broader privacy program. The following pages explain how we handle personal information and how people can exercise their rights:

Privacy requests and questions can be sent to support@reqev.com.

13. Personnel

REQeV personnel and contractors with access to Customer Data are bound by written confidentiality obligations.

Personnel are expected to follow our security policies, and violations may result in disciplinary action.

14. Compliance Status

REQeV does not currently hold a third-party security certification or attestation, such as SOC 2 or ISO/IEC 27001. Where we refer on this page to certifications, they belong to our service providers, not to REQeV.

We are happy to support customer due diligence. Security questionnaires and additional information about our practices are available on request, and may be subject to a non-disclosure agreement. To request them, email support@reqev.com.

15. Customer Responsibilities

Security is a shared responsibility. REQeV secures the Services, and customers are responsible for how they use and configure them, including to:

  • Use strong, unique passwords and keep login credentials confidential
  • Enable multi-factor authentication where the Services offer it
  • Add, remove and assign roles to their users promptly and appropriately, and remove access for people who leave their organization
  • Review and limit the permissions granted to integrations, API keys and browser extensions, and revoke access that is no longer needed
  • Keep API keys and other credentials secure and rotate them if they may have been exposed
  • Ensure they have a lawful basis and any required notices or consents for the candidate and contact data they place in the Services
  • Notify REQeV promptly at support@reqev.com if they suspect unauthorized access to their account

Use of the Services is also subject to our Terms of Service and Acceptable Use Policy.

16. Reporting a Vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability in the Services, please report it to support@reqev.com and follow our Responsible Disclosure Policy, which explains what is in scope, our rules of engagement and the safe harbor we provide for good-faith research.

17. Changes to This Page

We may update this page as our Services and security practices change. The updated version will be posted here with a new effective date.

18. Contact

For security questions, questionnaires or incident reports, contact us at: