Built to be trusted with your people data

Emissary carries conversations with candidates and employees for teams that answer to legal, IT and the people they text. Data is encrypted at rest and in transit, access follows least privilege, texting numbers are 10DLC-registered, and our controls are audited against SOC 2 Type 2 every year.

Book a demo

DATA HANDLING · EMISSARY SOC 2 TYPE 2

AT RESTAES-256 · encrypted with AWS KMS

IN TRANSITTLS 1.2 and 1.3 · HTTPS everywhere

ACCESSLeast privilege · role-based access control

HOSTINGAWS us-east-1 · redundant, backups in multiple US zones

TEXTING10DLC registered · STOP honored automatically

SCANNING · ALWAYS ON

GUARDDUTYHOSTEDSCANSONARCLOUDDEPENDABOT

Plus an independent penetration test every year.

Encrypted, pseudonymized and backed up

Everything Emissary stores is encrypted at rest with AWS KMS using AES-256, and everything in motion travels over HTTPS with TLS 1.2 or 1.3. Inside the app, every entity is pseudonymized with URL hashing. Emissary runs on AWS with a redundant configuration — the main server sits in us-east-1 (Northern Virginia) and backups are stored automatically across multiple availability zones in the United States.

AES-256 encryption at rest (AWS KMS) and TLS 1.2 / 1.3 in transit

URL hashing pseudonymizes every entity within the app

Periodic backup jobs for databases and buckets, stored in AWS storage across regions

See the full measures

EMISSARY · RECORD AS STORED

Priya R.Candidate · RN, Night Shift · Northside Health

ENTITY ID · URL HASHa9f3c7…e21c

AT RESTAES-256 · AWS KMS

IN TRANSITTLS 1.2 / 1.3 · HTTPS

REGIONAWS us-east-1 · N. Virginia

BACKUPS

Periodic backup jobs · databases and buckets

Stored automatically across multiple US availability zones

Copies held in AWS storage across different regions

ACCESS PATHS LEAST PRIVILEGE · RBAC

Recruiters and HR users → username + password, MFA through your SSO

Emissary personnel → SSO only, with MFA protection

Emissary engineers → SSH over VPN, IP and port filtered by firewall

Every role → only the permissions the job needs

Access on a need-to-know basis

Access controls at Emissary follow the Principle of Least Privilege and Role-Based Access Control, so people see only what their role requires. Your users sign in with a username and password and can turn on MFA through SSO integration. On our side, personnel reach internal systems exclusively through SSO with MFA, and developer access runs exclusively over SSH paired with a VPN and firewalling that filters by IP and port.

Least privilege and role-based access control throughout

MFA for your team through SSO integration

Emissary staff on SSO + MFA; engineers on SSH, VPN and IP/port firewalling

Compliant texting, built in

Your numbers are 10DLC-registered with the carriers, and the STOP keyword is honored automatically — when someone opts out, the texts stop. Every conversation keeps a full audit trail, and transcripts sync to the candidate or employee record in your ATS or HCM, so legal, HR and recruiting all look at the same history.

10DLC carrier registration for your texting numbers

Opt-out handling with the STOP keyword honored automatically

Full audit trail, with transcripts synced to the ATS or HCM record

See 1:1 texting

EMISSARY · OPT-OUT HANDLING

Marcus T.Candidate · Warehouse Associate · Ridgeline Logistics

10DLC REGISTERED

Hi Marcus, it's Ana from Ridgeline Logistics. Are you still interested in the warehouse associate role? Reply STOP to opt out.

STOP

You've been unsubscribed and won't receive further texts from Ridgeline Logistics.

AUDIT TRAIL · MARCUS T. SYNCED TO UKG

Oct 9 · 2:14SMS sent · Ana V. — "Are you still interested in the warehouse…"

Oct 9 · 2:20STOP received · opt-out applied automatically

Oct 9 · 2:20Record updated · opt-out status and transcript synced to candidate profile

Audited, tested and written down

Emissary follows SOC 2 Type 2 standards and is externally audited against them every year. Infrastructure, code and dependencies are scanned continuously and an independent penetration test runs annually. Written security policies and procedures are in place, read-only event logs are retained for at least 365 days, and physical security is handled by our hosting provider, AWS.

Audited

SOC 2 TYPE 2 · EXTERNAL AUDITAnnualSecurity controls audited by an independent third party each year.

Emissary follows SOC 2 Type 2 standards and is audited against them on an annual basis.

Tested

CONTINUOUS SCANNING

GUARDDUTY · AWSHOSTEDSCAN · EXTERNALSONARCLOUD · CODEDEPENDABOT · LIBRARIES

Plus an annual penetration test.

GuardDuty watches the AWS infrastructure, HostedScan scans from outside, SonarCloud reviews our code and GitHub Dependabot checks library dependencies.

Documented

GOVERNANCE

Written security policies and procedures

Read-only event logs retained 365+ days in AWS

Physical security via AWS data-center controls

Policies are written down, events are logged read-only for at least a year, and the data centers are run by AWS. The full detail lives in our Technical and Organizational Measures.

Read the full TOM Privacy policy