Kyrolane

Security overview

How Kyrolane keeps each organization’s data separate, who can do what, how mailbox credentials are protected, and where to find the legal documents.

On this page

Kyrolane holds candidate and client data on behalf of placement agencies, and job search data on behalf of job seekers. This section explains the controls that keep that data scoped, the rules that keep outreach compliant, and where the legal documents live.

Questions about security or a review request? Email [email protected], or use Support inside the partner portal.

What makes Kyrolane different

  • Organization isolation by design. Every partner record belongs to one organization, and every read is scoped to it, including exports and AI assistant tools.
  • A dedicated option. Partner Private runs on its own Kyrolane instance and database.
  • Least privilege by role. Coaches work the candidates and clients they own. Only admins save credentials or export the whole roster.
  • Encrypted mailbox secrets. SMTP passwords and OAuth tokens are encrypted before storage.
  • Audited access. Partner exports are written to a privacy audit log, and MCP tool calls are audited without storing payloads.
  • Consent you can see. Job seekers join or leave the talent pool themselves, and each change is recorded.

A good first task

Security review for a new agency

Confirm who on your team is an Admin and who is a Coach. Have an admin connect the agency mailbox and send a test email. Add the organization’s postal address. Then read the DPA and the subprocessor list, and share them with your compliance lead.

FAQ

Can one agency see another agency’s candidates?

No. Candidates, clients, and outreach belong to one organization. Portal pages, exports, and the MCP partner tools all read a single organization.

How are SMTP passwords and OAuth tokens stored?

They are encrypted before they are stored. Only organization admins can save them.

Is there a dedicated deployment option?

Yes. Partner Private runs on a dedicated Kyrolane instance and database with the same portal. Partner Shared is the multi-tenant service.

Where is the data processing addendum?

At /dpa. The list of subprocessors is at /subprocessors.

Who do I contact with a security question?

Email [email protected]. Partner members can also use Support inside the portal at /partner/support.

How do I make a privacy request?

Submit it at /privacy-request. Business contacts who want their email removed from the hiring-contact directory can use /opt-out.

Next steps

Security overview | Kyrolane | Kyrolane