Security at Lateral Talent
What we do today to protect your firm's data, stated plainly. We have not completed a SOC 2 audit and don't claim one.
Encrypted in transit
Every page and API call is served over HTTPS only, with HSTS so browsers never fall back to plain HTTP.
Each firm's workspace is separate
Pipelines, notes, candidates, files, submittals and settings belong to one workspace, and every query is scoped to the signed-in user's workspace. Other customers never see your candidates or activity.
Sign-in
Google or Microsoft sign-in, or a passphrase of 12+ characters. Passphrases are stored only as salted scrypt hashes, never in readable form. Sessions use Secure, HttpOnly cookies and every change is protected against cross-site request forgery.
Roles and seats
Admins invite teammates and set each person's role (admin, recruiter or viewer). Removing a teammate signs them out everywhere at once.
Activity log
Pipeline moves, outreach, submittals and other changes are recorded with who made them and when, so you can see what happened on a candidate.
Payments
Card payments are handled by Stripe's hosted checkout. Card numbers never touch our servers.
Your mailbox, only if you connect it
Connecting Gmail or Outlook is optional. It is used to send the outreach you write and to notice replies; you can disconnect it at any time from Settings.
Backups
Databases are backed up every night, encrypted, with the last seven nights kept.
Export and deletion
You can export your candidates and pipelines. Ask us and we will delete your workspace and its data.
Where profile data comes from
Attorney and licensee profiles are built from public records and public web pages, refreshed on a schedule. Nothing you add to your workspace is shared into those profiles.
Tell us what your firm needs and we'll answer directly. Contact us