Security and data protection

You're trusting us with your team's calendars and your candidates' details. Here's how we look after both.

Free and busy access only

When an interviewer connects a calendar, Kairo HR requests the narrowest permission that lets it see whether a time is free and create the invite you confirm. It does not read meeting titles, attendees or descriptions.

Data hosted in the UK

Our database runs in a London (eu-west-2) data centre. Our website is served from a global content network so pages load quickly wherever you are.

Encryption everywhere

All traffic uses HTTPS with modern TLS. Data is encrypted at rest by our infrastructure providers.

Least-privilege access

Access to production data is limited to the people who need it to run the service, protected by multi-factor authentication.

UK GDPR by design

Kairo HR collects only what it needs to schedule interviews, and keeps candidate data for as short a time as practical. Customers will act as data controllers and Kairo HR as their processor, under a data processing agreement.

Deletion on request

Customers will be able to delete candidate records at any time, and we delete customer data when an account closes.

Report a security issue

If you believe you've found a vulnerability, please email contact@kairohr.co with the details. We'll acknowledge your report within two working days.

Kairo HR is a new product. This page describes how the service is being built and will be updated as we add certifications and formal policies.