Security

Gem provides recruiting communication management services that allow recruiters to more efficiently source and engage with potential candidates. These services include email management, response tracking, and statistics to inform the efficacy of your recruiting efforts.

There are two components to the Gem services:

  1. Our web interface, Gem.com, where you can manage all of your outreach campaigns and reports
  2. A Chrome extension which is the primary tool for enabling your sourcing efforts

To access the Gem services, you will need to create a Gem account.

Your Gem account login credentials will be tied to your email account, so you’ll need to grant Gem permission to create that relationship through a technical standard called OAuth. The security of your data is our highest priority, so Gem will only interact with your other accounts via secure APIs. For clients using Gmail, we use the official Google APIs over SSL with user authentication done exclusively via Google SSO; for clients using Outlook, we use the Nylas API. In addition to this process being easier for users to manage by not having to remember another set of login credentials, we also believe this is more secure, since Gem never sees or stores user passwords.

During the account creation process, your email provider will ask you to verify that the permissions we request are appropriate. The permissions we ask for, and the reasons we need them, are as follows:

Gem needs Read, Compose, Send, and Permanently Delete access to your inbox:

Once your Gem account has been created, we store a minimal amount of your information going forward. We only store to/from email addresses and timestamps for emails in your inbox to power our feature that ensures your team doesn't reach out to the same person twice.

We DO NOT store the contents of any emails in your inbox except for emails you send in Gem through sequences, and a candidate's first reply to a Gem sequence.

For some of our most security-conscious customers, such as customers in the medical industry who may have Public Health Information (PHI) in their email, we support requesting more limited email access permissions. Limited access grants Gem access to email headers (like the to/from email addresses and timestamp), but not the contents of the emails in your inbox.

In addition to only interacting with your other accounts through secure APIs, we also protect your data throughout our system. All data at rest is encrypted using AES-256, via Amazon RDS's implementation, and all data in transit is encrypted using browser-based TLS. We also make use of a wide range of administrative and technical safeguards to ensure the Gem services operate in a safe environment.

The Gem services have been designed and developed with industry-leading cloud PaaS and LaaS providers. We use Heroku for our application servers and AWS for our databases, along with a few other AWS services without significant customer data or permissions. These providers maintain industry-standard security certifications, including ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3 and PCI DSS Level 1. Through the use of these scalable platform providers, we are able to leverage a number of features to allow us to minimize any potential impact to the availability of Gem and your data in the event of any potential natural disasters or system failures.

Gem has implemented a comprehensive set of internal security policies and programs to ensure that we are able to continually develop our services in the most secure way possible, allowing you to use Gem in a variety of environments subject to additional regulatory oversight such as HIPAA or OFCCP compliance. Gem has also been certified as adhering to the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks to allow for the transfer of personal data from the EU and Switzerland to our hosted AWS environments within the US.

As part of our commitment to providing a safe and secure service for the management of your private candidate data, we have developed Gem to operate within the requirements of the General Data Protection Regulation (GDPR) . GDPR is a European privacy law that went into effect on May 25th, 2018. It is based upon the European understanding that privacy is a fundamental human right. Established by the EU Parliament, the GDPR regulates how individuals and organizations can obtain, use, store, and remove personal data. It gives EU citizens and residents control over their personal data, and simplifies the regulatory environment for international business that takes place in the EU.

Here is an overview of how Gem has prepared to meet the new regulation requirements:

To help us continue to maintain the most secure platform possible, we have partnered with NCC Group, a global information assurance specialist, to perform objective, third-party audits of Gem on an annual basis. We are performing regular vulnerability scans at both the network and application level to ensure our compliance with both WASC (Web Application Security Consortium) and OWASP (Open Web Application Security Project) standards.