Security
Built to hold as little as possible.
Tenant isolation enforced in three independent layers, mandatory MFA with a fresh re-check before every high-risk action, encryption at rest, and an append-only audit trail that can't be edited even by a compromised application connection.
No DB grant
The pre-auth database role has zero SELECT/INSERT privileges on candidate or project tables — not policy, a missing grant.
Row-Level Security
Every tenant-owned table is scoped to your company at the database level, enforced even against a compromised query.
App-layer re-check
The application independently re-verifies company ownership on every read, regardless of what the database already enforced.
Architecture
Five real mechanisms, not a badge.
Tenant isolation
Three independent layers protect every candidate and project record: no database grant, Row-Level Security, and an application-layer re-check.
Mandatory MFA & step-up
Every account enrolls in MFA. High-risk actions — inviting a teammate, revealing an identity, purging a project — require a fresh password-and-code check first.
Encryption at rest
Candidate PII, resume files, and MFA secrets are encrypted the moment they're stored, never held in plaintext.
Append-only audit log
Every login, reveal, and purge is recorded. The audit table itself can't be edited or deleted, even by a compromised application connection.
Rate limiting
Per-IP and per-account limits work together, so credential stuffing spread across many addresses is still caught.
Step-up, in practice
Zero-Trust access, made concrete.
Being signed in isn't enough for the actions that matter most. Before any of the below, Phantom asks for a fresh password and MFA code — no exceptions, regardless of how recently you logged in.
- Inviting a teammate
- Revealing a candidate's identity
- Purging a project
- Reading a revealed identity
Fresh check requested
Password plus MFA code, even if you signed in minutes ago.
Action proceeds
The check is short-lived and single-purpose — it can't be reused for anything else.
Security, by the people who've lived it
Phantom Hire is built by a team of industry-leading security professionals alongside Talent Acquisition specialists with over ten years of hands-on hiring experience. They know exactly what a hiring pipeline collects, and exactly why it shouldn't keep it.
Vault-encrypted identities
Candidate PII never sits in the day-to-day workspace. It's encrypted the moment it's collected.
Owner-gated reveals
Only an Owner can reveal a candidate's identity, and only with a reason recorded against their name.
Role-based access
Five distinct roles, from Owner to Interviewer, decide exactly what each person on your team can see and do.
Tenant-isolated by design
Every query is scoped to your company at the database level, with no shared table to misconfigure.
Built for both sides of the hire
Zero-Retention isn't a feature bolted onto a normal ATS. It's the reason Phantom Hire exists. The less a platform holds onto, the less there is for anyone to lose, leak, or misuse. Here's what that principle actually delivers, depending on which side of the hire you're on.
For hiring teams
- End-to-end encrypted workflow. Every candidate record moves through your pipeline encrypted at rest, decrypted only for an Owner, only for a stated reason, only for as long as it takes.
- Fit ranking your team can trust at a glance. Every candidate is scored Strong, Good, Possible or Weak Fit the moment their CV lands, so screening time goes to the right conversations first.
- Nothing left to subpoena. When a search closes, there's no residual database of names, CVs or notes sitting around waiting to become tomorrow's liability.
- Zero-Trust access as standard. Every teammate signs in with MFA, and high-risk moves like revealing an identity, purging a project, or inviting a teammate require a fresh password-and-code check, no exceptions. See, and revoke, every signed-in device from your Security Centre.
For candidates
- A Passport, not a profile. Your Phantom Passport travels with you across every role you explore, private by default, revealed only when you choose.
- Matched on skill, not visibility. AI matching finds roles that fit what you can actually do, not what a keyword search happens to catch.
- Explore under Shadow, our anonymous talent network, where you exist as a Callsign until the moment you decide to step forward.
- Verification without exposure, on the roadmap: reusable, cryptographic credential checks, so you prove you're qualified without re-submitting sensitive documents to every company you talk to.
Ready to hire without the paper trail?
Bring Phantom onto your next role. He'll do the work, keep your team aligned, and leave nothing behind when the job is done.
Start hiring with Phantom