.png&w=384&q=75&dpl=dpl_9SjeWpxK3G3ycvkDFTPYMABK2Wau){kind=small}
Enterprise security in an ATS: what to require before buying
An ATS is one of the most sensitive systems a company runs: it holds resumes, contact data, evaluations and sometimes salary information for hundreds or thousands of people. When that ATS also uses AI to process this data, security stops being a compliance checkbox and becomes a central decision criterion. This guide explains what SOC 2 and GDPR mean, which controls matter and how to evaluate a vendor.
Key Takeaway
If an ATS vendor can't show you third-party audited evidence — and only offers marketing statements about how "secure" they are — treat that as the answer. Enterprise security is proven with certifications and a Trust Center, not with adjectives.
SOC 2 Type II: the trust standard
SOC 2 is a certification that audits a vendor's security controls across five criteria: security, availability, processing integrity, confidentiality and privacy. The difference between Type I and Type II is key:
- Type I evaluates the design of controls at a single point in time.
- Type II evaluates that those controls operate consistently over time (typically 6-12 months).
For an ATS, SOC 2 Type II is the floor. It proves, with evidence audited by an independent third party, that the vendor protects candidate data on a sustained basis.
The controls that matter
| Control | What it solves |
|---|---|
| Encryption in transit and at rest | Data travels and is stored encrypted |
| Enterprise SSO (SAML) + SCIM | Access governed by your corporate directory |
| Role-based access controls (RBAC) | Each user sees only what they should |
| Audit logs | Traceability of who accessed what |
| Incident response plan | What happens if something goes wrong |
| AI data governance | Where it's processed and whether it trains models |
The extra layer when AI is involved
An AI-powered ATS adds a question a traditional ATS never had: what happens to candidate data when a model processes it? The concrete questions to ask:
- Where is data processed (region, subprocessors)?
- Is candidate data used to train third-party models? (The correct answer is usually "no.")
- Is there isolation between different customers' data?
- Can a candidate's data be deleted on request (right to be forgotten)?
GDPR: the de facto standard
Even if your company isn't in Europe, GDPR matters: it applies if you process data of European residents and, beyond the legal obligation, it became the maturity benchmark for data protection. Many companies in LATAM already require it from vendors as a filter, because it guarantees practices like data minimization, consent, right to be forgotten and portability.
Vendor evaluation checklist
- Does it hold a current SOC 2 Type II (not just Type I)?
- Is it GDPR compliant?
- Does it offer encryption in transit and at rest?
- Does it have enterprise SSO with SCIM and RBAC?
- Does it document where data is processed with AI?
- Does it guarantee data isn't used to train third-party models?
- Does it have a public Trust Center with evidence?
How Selenios solves it
Selenios holds SOC 2 Type II certification, GDPR compliance, encryption in transit and at rest, enterprise SSO with SCIM, role-based access controls and a public Trust Center documenting these guarantees. Security isn't a separate module — it's part of the product design.