Security Overview

Last updated: March, 2026

This page provides a high-level overview of our security approach. It is intended as a general summary only and does not modify any contractual commitments.

Our Approach

We design our systems and internal processes to support the confidentiality, integrity, and availability of the data entrusted to us. Our security program is intended to reduce risk through layered administrative, technical, and operational safeguards.

Infrastructure and Hosting

Needle uses modern cloud infrastructure and service providers to operate its platform. We aim to select providers that offer strong security controls, operational reliability, and ongoing platform hardening.

We design our systems with attention to:

• service reliability

• environment separation where appropriate

• secure configuration practices

• logging and operational visibility

• backup and recovery processes

Access Controls

We work to limit access to systems and data to authorized personnel who require it for legitimate business purposes.

Our approach may include measures such as:

• role-based or least-privilege access principles

• authentication controls for internal systems

• review and removal of access when no longer needed

• monitoring of administrative activity where appropriate

Encryption and Data Protection

Needle uses safeguards designed to protect data in transit and at rest where appropriate to the nature of the system and data involved. We also work to reduce unnecessary data exposure through system design, access restrictions, and operational controls.

Secure Development Practices

Security is part of how we design, build, and operate our product.

Our development and release practices may include:

• code review

• testing before deployment

• dependency and vulnerability monitoring

• change management processes

• prompt remediation of identified issues based on severity and risk

Monitoring and Incident Response

We use monitoring, logging, and alerting practices intended to help us detect, investigate, and respond to suspicious activity, service issues, and security events.

If we identify a security incident affecting customer data, we will investigate, take appropriate containment and remediation steps, and provide notifications as required by law or contract.

Vendor and Subprocessor Management

Needle relies on third-party providers for certain infrastructure and operational functions. We evaluate providers based on business and security considerations and work to ensure they are appropriate for the services they support.

Employee and Internal Security Practices

We maintain internal practices intended to support secure operations, which may include:

• confidentiality obligations

• internal access restrictions

• onboarding and offboarding controls

• security awareness practices

• escalation paths for security concerns

Shared Responsibility

Security is a shared responsibility. Customers using Needle are also responsible for configuring their use of the platform appropriately, managing their own internal access practices, and reviewing the information they collect through their recruiting workflows.

Reporting Security Concerns

If you believe you have identified a security issue involving Needle, please contact us at:

security@needle.so

For vulnerability reports and testing guidelines, please see our Vulnerability Disclosure page:

https://needle.so/vulnerability-disclosure

Questions

If you would like additional information about Needle’s security practices, please contact: security@needle.so