Security and data handling

How Wavaron works

Wavaron is a managed service. Our team and our automations research your market, rank opportunities, prepare plays and run the campaigns your team approves. Your recruiters make the calls and own every client and candidate relationship. We work on top of your existing systems, using a small set of established business tools rather than a database of our own.

What we hold

Depending on what you choose to share, we may hold:

• your niche, role families, geography, target employers and exclusions
• public hiring information about those employers, with the source and date
• business contact details for hiring managers and decision-makers
• candidate, client and placement fields from your ATS or CRM that you authorize
• the campaigns, messages and replies for plays your team approved
• job orders, placements and gross profit that you report to us

What you control

We ask for data in stages, and only when it changes the result.

• To start (week one): your niche, market and the employers you want. That's enough for your first researched opportunities. No ATS or CRM access needed.
• Optional, early: a short summary of recent placements, in a spreadsheet you prepare. You choose the fields.
• Later, once you've seen the work: read-only access to the candidate, client and placement fields we agree on in writing, or a regular export if you prefer.
• Always: which employers we watch and which we leave alone, every message before it's sent, and whether to delete any of your data.

We never ask for Social Security numbers, banking or pay details, background check results, immigration documents or health information. If those fields exist in your ATS, we exclude them from the access we set up.

How access works

• We use a separate login or API key for Wavaron, never a recruiter's or admin's password.
• Access is read-only wherever your system supports it, and limited to the agreed fields.
• You can revoke it at any time, from your own system, without asking us.
• We don't change records in your ATS or CRM unless you've approved that specific workflow.
• Sending domains and inboxes for your campaigns are registered in your firm's name. Disconnecting them ends our access.

Who can see your data

• Only the Wavaron team members working on your account.
• Every account that holds client data uses multi-factor authentication.
• Each client's data is kept separate and is never shared with another client.
• We may use de-identified, aggregated patterns, such as which kinds of signals tend to lead to job orders, to improve our scoring. They never include names, candidates, contacts or anything that identifies your firm.

The tools that process it

Each tool only receives the data its job needs.

• Workflow automation (n8n): moves data between steps and runs the scoring.
• AI models (Anthropic, OpenAI): research, matching and drafting, through API and business accounts.
• Research and enrichment (Clay, AI Ark): employer and hiring-manager data from public and licensed business sources. These tools build campaign contact lists. They don't receive your candidate records.
• Email and LinkedIn sending (Smartlead, HeyReach): the contacts and messages in campaigns your team has approved.
• Workspace (Google Workspace): shared sheets, reports and email between our teams.

The current list is part of your agreement, and we'll tell you before adding a new tool that processes your candidate data.

Encryption

Data moves between your systems, our tools and your team over encrypted connections. The business platforms we use encrypt the data they store.

AI and your data

We use AI through API and business accounts whose terms don't allow your data to be used to train their models. AI drafts and ranks. People check the evidence, and your team approves every play before anything is sent. Candidate profiles in outreach are anonymized unless your recruiter decides otherwise.

Retention and deletion

• While we work together, we keep your data only as long as it's needed for the work.
• You can ask us to delete specific data at any time.
• When we stop working together, we hand over an export of everything we built for you, then delete your data from our tools within 30 days and confirm it in writing.
• We may keep a small amount of information longer where the law requires it, such as opt-out lists so people who asked not to be contacted aren't contacted again, and billing records.

Outreach rules

Campaigns run on domains in your firm's name, with authentication set up properly and volume increased gradually. Every email includes a way to opt out, and opt-outs are honored across your campaigns. We don't send anything your team hasn't approved.

Incident response

We watch the accounts and tools that hold client data. If we confirm an incident affecting your data, we'll tell you without undue delay, as your agreement and the law require, with what happened, what was affected and what we're doing about it. We'll help you revoke and rotate any access involved.

Contracts

Before any candidate or client data is connected, we sign a data processing agreement that covers these commitments: what we access, what we use it for, which tools process it, how long we keep it and how it's deleted. Want to review it before your strategy call? Ask for a copy.

Compliance

• We don't hold a SOC 2 report today. If your firm or your clients need a security questionnaire completed, we'll complete it.
• Wavaron isn't set up to handle protected health information (PHI), so we don't accept it.
• Privacy requests about personal information are covered in our privacy policy.

Responsible disclosure

If you find a vulnerability, email wasey@wavaron.com with the details, the steps to reproduce it and how to reach you. We commit to:

• acknowledging your report within 2 business days
• giving you a timeline for triage within 5 business days
• not pursuing legal action against good-faith research that respects people's privacy

Please don't access other people's data, run automated scans against our tools or test denial-of-service scenarios.

Changes and contact

When this page changes, we update the date at the top and tell clients about material changes by email. Questions about security or your data: wasey@wavaron.com.