Understanding And Managing Ashby’s Access Requests for Security Teams
This guide outlines frequently asked questions from security teams. Please note that this page is for informational purposes only. Although we do our best to keep this information up-to-date, you should always refer to our Terms, Privacy Policy, our Trust Center or your signed agreements with Ashby for the most accurate information. Please reach out to [email protected] if you have questions not addressed in this page.
Overview
This guide helps IT and security teams understand how Ashby integrates with your systems and what access it requires, to enable evaluating tradeoffs. It includes:
- A breakdown of Ashby’s platform and security model
- Integration options for SSO, and SCIM
- Links to more detailed, relevant documentation
Use this guide to make informed decisions that balance integration benefits with your organization’s risk posture.
About Ashby
What does Ashby do?
Ashby is an all-in-one recruiting platform that replaces several software classes your Talent team may use. As a result, Ashby’s integration with IT systems requires access similar to the software it replaces. Below is a summary:
Software Class | Comparable Software | Data Access |
|---|---|---|
ATS | Greenhouse, Lever | HRIS Read/Write (e.g., Workday) |
Sourcing/CRM | Gem, SourceWhale, Interseller | Email Read/Send |
Scheduling | Calendly, GoodTime, Modernloop | Calendar Read/Write |
Ashby requests the minimum access necessary to provide full functionality. While you can limit access, it may impact the Talent team’s experience. This document aims to help you assess your options and their tradeoffs to make an accurate risk assessment of Ashby.
Security, Privacy, and Reliability at Ashby
The integrations we request give Ashby access to data sensitive to your company, and we take this responsibility seriously. Here are the measures we take:
- Conduct annual SOC2 Type II audits and White-Box pentests.
- Use vulnerability detection tools for infrastructure, third-party packages, and applications.
- Employ a global team of reliability engineers for high availability and security.
- Provide resources for compliance with privacy laws like GDPR and CCPA (GDPR Overview).
All data in Ashby:
- Is encrypted at rest and in transit.
- Is logically separated per customer and stored behind a VPC.
For details, see our Security Overview.
What access does Ashby request?
Ashby integrates with Google Workspace and Microsoft 365 to provide features that enhance hiring speed and efficiency. These integrations increase the risk profile of Ashby as a vendor, but provide significant benefits to your Talent team.
Ashby requests access to the emails and calendars of your team members involved in the hiring process. Ashby will store a subset of this data in our database to allow us to provide a fast and reliable user experience. Our database is encrypted at rest, logically separated by customer, and behind a VPC. All data transmitted between your IT systems, Ashby’s servers, and Ashby’s clients are encrypted in transit. For more information, please read our security overview.
Email (via Google Workspace and Microsoft 365)
For more on these two integrations, check out Integration options for Google Workspace and Microsoft 365
Ashby supports email syncing via Google Workspace and Microsoft 365 when relevant to the hiring process. Only emails from Ashby users with an Elevated Access or Organization Admin role are synced since these roles are assigned to employees involved in the hiring process.
From these users, we only store emails sent from Ashby or involving a candidate:
- Emails containing a to, cc, or bcc with the candidate’s email and subsequent emails marked by the email provider as being in the email thread.
- Emails sent from Ashby and subsequent emails marked by the email provider as being in the email thread.
- If the candidate's domain matches your organization's auth domain, emails will not be synced for that candidate. If the candidate has two email addresses linked to their profile (one with the organization's auth domain and one without) emails including the email address without the organization's auth domain will still be synced.
Ashby provides additional controls within the application to:
- Mark emails as private and automatically mark emails during the offer stage as private. Viewing these emails requires an explicit access role in Ashby.
- Hide emails when a candidate moves to offer and hired stages.
- Not sync emails related to a candidate after they are hired.
- Not sync emails related to a candidate considered for a confidential job
Calendar (via Google Workspace and Microsoft 365)
Ashby supports calendar syncing via Google Workspace and Microsoft 365.
What gets synced:
- All accessible calendars and events, including shared calendars (e.g., “Interviews” calendar).
- Personal calendars are used to determine interviewer availability.
Privacy and visibility controls:
- Ashby respects calendar settings:
- Events marked as "Private" are not shown in detail.
- Events shown as "Free" or "Busy" will only display availability.
- Calendar visibility settings are honored during scheduling to protect sensitive information.
How does Ashby manage user access?
Ashby offers a secure and flexible authorization model with granular permissions to manage user access. We also apply a strict permission system within Ashby where users are granted access to jobs and candidate records on a need-to-know basis (see “Access Control” below).
Our default user access is very limited, and can’t access any candidate or job data. Employees cannot access their candidate profile (their candidate profile must be linked to their employee profile in Ashby to prevent this). And we support truly confidential jobs that only the creator and those they give access to can see.
Our Authorization Model
By default, Ashby assigns new users a "Limited Access" role. These users can:
- Submit interview feedback for interviews they participated in.
- Submit referrals or applications for internal jobs.
Limited access users cannot:
- View sensitive information, such as jobs or candidates.
- Sync or send emails through Ashby.
Ashby provides granular permission settings for administrators to customize user access. Full details are available in Ashby Knowledge Base.
Single Sign-On (SSO) and Directory Sync
Ashby supports SSO via Google Workspace, Office 365, or Okta.
- User Offboarding: Offboarded users in your directory automatically lose Ashby access.
- User Onboarding: New users are automatically assigned the "Limited Access" role.
Account Sync for Non-Employee Accounts
When syncing with your domain provider (Google or Microsoft), non-employee accounts, such as contractors or service accounts, may also appear in Ashby.
By default:
- Non-employee accounts are assigned the "Limited Access" role.
- These users can log in and be scheduled for interviews but cannot view sensitive data like jobs or candidates.
Management Options:
- Disable Access: Organization Admins can revoke access for any synced account.
- Contractor Access: For contractors requiring limited access, Ashby supports Agency Users. Learn how to share your account selectively.
Audit Logging
Ashby maintains audit logs to track changes to important records.
- Logs are not currently accessible via the product or API but can be provided upon request through Ashby Support.
Ashby Bot and Ashby Success Users
On the Employees page, you will see two system users:
- Ashby Bot: Used to associate API usage and automation with a specific user for auditing purposes.
- Ashby Success ([email protected]): Used by our support team (with your permission) to assist with troubleshooting or changes.
These users cannot be removed, as they are required to provide support and maintain system functionality.