This FAQ provides technical and security information about Greenhouse Analytics to support your organization's vendor security assessment.
This is not intended to be legal advice. The answers provided are also not intended to override or contradict the advice of your legal counsel.
How do users authenticate, and do you support SSO and MFA?
Users sign in through the Greenhouse identity platform using OAuth 2.0 with PKCE. Analytics does not store customer passwords separately - it uses your existing Greenhouse login and configured authentication policies such as SSO and multi-factor authentication.
How is my organization's data isolated from other customers?
Tenant isolation is enforced at multiple layers. Every metadata query is scoped to your organization using an identity derived server-side from your session. Your analytics data lives in its own dedicated data store and files, queried by a per-organization engine that is only permitted to open your organization's files. There is no shared table from which one customer could read another's data.
Who can access my data, and how do you enforce least privilege?
Access is denied-by-default. Role-based access control gives each user fine-grained permissions to view, create, edit, delete, and share dashboards, data views, and visualizations, and every request is authorized before any data is returned.
Greenhouse Analytics shows up as an available option for users with the Site Admin permission. Greenhouse Analytics accounts are created after their first sign-in for Site Admins with an Admin role. All other users are granted access if they're granted permissions to a data view or dashboard. All other users start as Viewer; from there, roles (Admin, Creator, Viewer) are managed within Analytics by users with an Admin role.
Where is my data stored, and is it encrypted at rest and in transit?
Data is stored in AWS S3 in the United States (AWS US-East region) with server-side encryption at rest. All traffic is served over TLS/HTTPS.
Does the analytics platform connect to your production systems? How does data get in?
No. The analytics platform has no live connection to, and no credentials for, Greenhouse's primary production databases. Data is delivered through a one-way pipeline that refreshes your analytics dataset once per day via an overnight batch process. Your analytics data reflects your Greenhouse data as of the previous night's refresh - in normal operation it's typically within about 24 hours of your live Greenhouse instance, and it's never a live view. Customers cannot trigger or influence that pipeline, and there is no route from the analytics interface back into production systems.
If users can run queries, how do you keep that safe?
Query access is read-only against an immutable snapshot and restricted to Creator/Admin roles. Only single SELECT statements are allowed - data-modifying, administrative, and multi-statement queries are rejected at two independent validation layers. The engine runs with network and external file access disabled, extensions blocked, and its configuration locked. Permissions are enforced, meaning a query can only ever return data you're already authorized to see.
How do you log, monitor, and audit access and activity?
Requests are logged on Greenhouse internal systems in a structured format with correlation IDs and distributed tracing into centralized monitoring, real-user monitoring, and error-tracking systems. Administrative actions (role and settings changes, content lifecycle) are captured in an organization-scoped audit log.
Note: Greenhouse Analytics events aren't currently included in the Greenhouse Audit log add-on.
Does Greenhouse conduct penetration testing for Greenhouse Analytics?
Yes, the product underwent third-party penetration testing and internal security review, with findings tracked to remediation according to the SLAs in our Vulnerability Management Policy.
How long is my analytics data retained?
Analytics snapshots are retained for a rolling window of 7 days, enforced automatically by a storage lifecycle policy that permanently deletes anything older. Your dataset is rebuilt in full every night from your current Greenhouse data, so snapshots don't accumulate historical copies - at any time, the platform holds only the last several nightly snapshots (past 7 days), and older ones are deleted automatically. All snapshots are encrypted at rest and are never publicly accessible.
What happens to my data in Analytics when I delete it in Greenhouse?
Every nightly refresh is a complete rebuild of your analytics dataset from your current Greenhouse data - the pipeline fully replaces (overwrites) the prior snapshot rather than applying incremental changes on top of it. As a result, any record you delete (or anonymize) in your Greenhouse instance is absent from the next nightly snapshot, which entirely supersedes the previous one. Any earlier snapshot that still contained the record then auto-expires within the 7-day retention window described above. There is no write path through the product to alter analytics data directly, and no way for a deleted record to persist beyond one refresh-plus-retention cycle.
What happens to a user's access when I remove or change their permissions in Greenhouse?
Because sign-in is delegated entirely to the Greenhouse identity platform, revoking a user in Greenhouse revokes their access to Analytics. Every new Analytics session can only be created after a freshly issued Greenhouse access token is validated, so a user who has been removed or suspended in Greenhouse can no longer obtain the credential needed to start a session.
A user's role is read from Greenhouse at each sign-in, so permission and role changes made in Greenhouse take effect at their next login. Analytics sessions are held server-side and can be terminated centrally, and each Greenhouse access token is short-lived and can establish only a single Analytics session.
What security and privacy certifications does Greenhouse hold, and can I get the reports?
Greenhouse Analytics is built and operated within Greenhouse's broader information-security program and AWS infrastructure. Greenhouse undergoes independent third-party audits on an annual basis - SOC 1 Type 2, SOC 2 Type 2, ISO 27001:2022, ISO 27701:2019, and ISO 42001:2023 - and maintains alignment with GDPR, CCPA/CPRA, and the EU-U.S. / UK / Swiss Data Privacy Frameworks. Copies of the SOC reports, ISO certificates, and penetration-test executive summaries are available under NDA through the Greenhouse Trust Portal.