Security
How keys and candidate data are protected.
- Keys are stored as SHA-256 hashes and shown once. Customer ATS credentials that Capstone needs for outbound calls are encrypted at rest with AES-256-GCM.
- A key belongs to one company. The company is always taken from the key, never from a URL or request body.
- Revoking an API key or rotating a partner key stops the old key on the next request.
- Candidate emails are never written to logs.
- Callback URLs that arrive in a request body are pinned to the ATS's own domain before Capstone will call them.
- Another company's resources return
404, not403, so their existence cannot be probed.
To report a security issue, contact your Capstone partner manager.