Information security is a key company priority at LiveHire and we manage robust security controls to enhance the confidentiality, integrity and availability of our information assets and systems.
Our key objective is to safeguard customer data and our security controls are driven by a comprehensive risk management framework that governs many aspects of LiveHire’s business operations.
Being a cloud native company, LiveHire takes necessary precautions to ensure all client and user data never leave the secure cloud environment and are always protected under the highest standards.
Trust Center Updates
After careful review of our infrastructure and application code, the LiveHire team has determined that we are not currently vulnerable to the OpenSSL 3 vulnerabilities CVE-2022-3602 and CVE-2022-3786 that were disclosed on November 1, 2022.
As a helpful resource, you can use this page to determine if certain widely used software in your environment is affected or unaffected: https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md
LiveHire achieves SOC 2 Type 1 Attestation.
System and Organization Controls (SOC 2) attestation are based on the Trust Services Criteria defined by the AICPA and reports on controls relevant to security, availability, confidentiality, and privacy.
You can now download the report from our security portal.
LiveHire's team has been closely tracking the Spring4Shell CVEs (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965). Please see the updates below:
LiveHire does not use Java internally, and core platform functionality likely was not directly vulnerable.
Our Web Application Firewall (WAF) has had top level mitigation rules in place for all traffic to livehire.com, blocking any attempts to exploit this vulnerability.
We are currently reviewing all 3rd party components and vendors used by our platform and across our business, and work with them to identify and eliminate any other potential risks. No potential impacts identified till date.
While the LiveHire product allows customers to authenticate using Okta, we do not use Okta internally. As a result, at this point in time, we do not have any reason to believe we were affected. Please reach out to us at email@example.com if you have any further questions or concerns.