Security and Compliance
At Censia, the security of your data and your compliance with legal requirements is our top priority. Censia’s platform has robust security measures in place to safeguard the transmission and storage of the information you share with us.
Top Security and Privacy Features
Data Protection in the Cloud
We rely on the best in class secure service providers to ensure that your information is safe. Censia’s services run on Amazon Web Services (AWS), which is physically secure and employs modern software security techniques and is trusted by hundreds of thousands of businesses globally.
We protect your information as it’s being transmitted between systems. Censia integrates seamlessly with HRIS Platform systems (ATS, CRM, HRIS) without compromising the security of your data. Communication through HRIS partner APIs is HTTPS encrypted using TLS 1.2. Connections are encrypted and authenticated using AES-256 bit encryption. The Advanced Encryption Standard (AES) is used by the U.S. government to protect classified information and also used commercially to protect sensitive data in software.
We make your data unreadable to those who shouldn’t be reading it. In addition to encrypting API traffic to and from your HRIS systems, Censia encrypts other sensitive company data you share with us. We use the Key Management Service (KMS) through AWS to control and separate encryption keys used to encrypt your data. KMS employs Hardware Security Modules (HSMs) to protect the security of keys. Keys can never be exported from the service. All data is encrypted at rest and in transit between nodes, so you can be sure your information is secure.
We don’t hold on to your passwords – we never even see them. Censia never stores user passwords. We utilize a one-way, cryptographic hashing algorithm.
Strong Access Protection
We protect customer data from other customers. Choosing a recruiting platform without strong access protections in place can pose serious security risks. Censia does not share your data with our other customers. Rigorous access controls restrict customers to their data only. Personally identifiable information from your applicants will never be available to others.
Don’t just take our word that our systems are secure. We don’t. Censia has partnered with a reputable, global information assurance specialist, 24x7, to perform objective, third-party security audits on an annual basis. Vulnerability scans are performed at both the network and application levels. The testing methods test our compliance with both WASC (Web Application Security Consortium) and OWASP (Open Web Application Security Project) standards.
We prepare for the worst, just in case. To become fully operational in the case of a disaster, Censia’s data is stored in an AWS Aurora, which is natively resilient. In case of an infrastructure failure, it performs an automatic failover process, ensuring minimal downtime and maximum reliability.
Security Training for your Team
We help your team follow security best practices too. We know that the HR team members using Censia products are not seasoned, security experts. As part of our customer onboarding process and user training, our customer success team provides underlying security best practices and recommendations to all Censia product users.
Our staff is trained to handle your data correctly. Censia employees with access to sensitive customer data can only access information on a need-to-know basis for troubleshooting purposes and are required to adhere to strict privacy guidelines. For access to our production systems, all engineers use multi-factor authentication and are restricted by IP location – a process we carefully track and audit. Customer data is never copied locally onto employee computers. Additionally, all new employees are subject to a pre-employment background check to verify identity, references, criminal history, etc. As part of their onboarding, all Censia engineers agree to an Information Security Management System. The goal of an ISMS is to minimize risk and ensure business continuity by preventing unauthorized access to data and limiting the impact in the unlikely event of a security breach.