Careers Website Security, Accessibility and Compliance: A Buyer's Guide
Careers website security, accessibility and compliance are the checks that decide whether a careers website clears your security review. This guide shows what Happydance publishes and what to ask any provider.
By the Happydance team. Updated November 2026.
Why security reviews decide careers website projects
A careers website touches your brand, your jobs feed and often your candidates' first contact with you. Security, privacy and accessibility teams will review it, and a slow review can stall a project that everyone else wants.
The evidence a provider can show about how it protects data, keeps the careers website available, meets accessibility standards and handles personal information, ideally from independent third parties.
This page has two jobs. It tells you what Happydance publishes, and it gives you a list of the questions to put to any provider. For the complete, current detail see the Happydance security page, and for contracts see the legal documents. Where this page and the security page differ, the security page is the source of truth.
At a glance: what Happydance publishes
| Area | What we publish | How to verify |
|---|---|---|
| Security audit | SOC 2 Type 2 report by A-LIGN covering Security and Availability. The next audit period runs from 1 July to 31 December 2026 and the audit is in progress. | Ask for the report. It is shared under NDA. |
| Information security | ISO/IEC 27001:2022 certification by BSI for the whole careers website platform | Check the certificate number in the BSI client directory. |
| Cyber Essentials | Certified, covering the whole organisation | Ask for the current certificate. |
| Penetration testing | Annual independent manual test, plus automated scanning with AppCheck-NG and code analysis with GitHub Advanced Security and Dependabot | Ask for the summary and remediation status. |
| Hosting and data residency | Each customer chooses US, UK or EU on the Order Form. Data sits in Central US, UK South or Germany West Central, in the customer's own database. Cloudflare provides a web application firewall, DDoS protection and TLS in front. | See the security page. |
| Recovery | A recovery time objective of 12 hours and a recovery point objective of 12 hours, including for the CMS | Ask for the SLA and recovery terms. |
| Availability | 99.9% availability for Elite support and 95% for Standard support, with service credits of 10% of the monthly fee for the downtime period | Read the SLA and check status.happydance.love. |
| Data protection | Happydance acts as processor and the customer as controller, with a data processing agreement and a published sub-processor list | Read the DPA and sub-processor list. |
| Accessibility | Supports WCAG 2.1 Level AA, per our Accessibility Conformance Report (VPAT 2026-06, dated 17 June 2026) | Ask for the Accessibility Conformance Report. |
These statements are drawn from our published security page and confirmed by the Happydance team. We update the security page first.
Independent assurance
As published on the Happydance security page. Dates, scope and certificate numbers are on that page.
SOC 2 Type 2. The report tests whether controls operated effectively over a period, not just on one day. Ours covers Security and Availability and is available to customers under NDA. The next audit period runs from 1 July to 31 December 2026, and the audit is in progress.
ISO/IEC 27001:2022. The certificate covers the whole careers website platform for the UK and US. You can check it directly with the certifying body rather than taking our word for it.
Cyber Essentials and penetration testing. Happydance holds Cyber Essentials. An independent specialist carries out a manual penetration test each year, with the next one planned for April 2027. Between tests, AppCheck-NG scanning, GitHub Advanced Security static analysis and Dependabot dependency checks keep watch. Ask for the latest summary when you review us.
Check dates, not logos
A certificate is only worth what its date and scope say. Ask any provider for the report period, the issue date, the scope and the certifying body, and check that the scope covers the product you are buying.
Data protection, GDPR and candidate data
Happydance acts as a data processor for customers, who remain the controller of their candidate data. A data processing agreement, a published list of sub-processors and the terms are in the legal documents. Our privacy policy explains how we handle personal information.
Where candidate data goes depends on how applying is set up. A customer can redirect candidates to the ATS, embed the ATS application form on the page, or use the Happydance easy-apply overlay. With a redirect or an embedded form, the application is made on the ATS. The easy-apply overlay passes the application to the ATS without Happydance storing it. See the easy apply overlay and our careers website integrations.
What Happydance does store. Where Job Alerts is enabled, we store the subscriber's email address, their search criteria and their language, so the alerts can be sent. Analytics use Google Analytics 4, and Microsoft Clarity runs only with the visitor's consent.
AI and your data. AI features run in inference-only mode, and customer and candidate data is not used to train models. Messages sent in conversational search go to OpenAI and are retained for up to 30 days for abuse monitoring. The AI sub-processors are OpenAI, the Vercel AI gateway and Azure AI Vision, which writes image alt text. The sub-processor list in the legal documents is the current record.
Hosting, availability and recovery
A new customer chooses US, UK or EU on the Order Form. Its careers website data is then held in Central US, UK South or Germany West Central respectively, in the customer's own database. Cloudflare sits in front of the platform for a web application firewall, DDoS protection and TLS.
The SLA commits to 99.9% availability for Elite support customers and 95% for Standard support customers, measured monthly. If availability falls below the level for your package, the service credit is 10% of the monthly fee for the downtime period. Recovery objectives are a 12-hour RTO and a 12-hour RPO for everything, including the CMS. Live status is public at status.happydance.love, and the full terms are in the legal documents.
Performance matters to trust too. Core Web Vitals are tracked daily on every Happydance careers website against Google's thresholds.
Accessibility: what Happydance provides and what you control
Happydance careers websites support WCAG 2.1 Level AA, as recorded in our Accessibility Conformance Report (VPAT 2026-06, dated 17 June 2026). The report is available on request. WCAG 2.1 AA is also the foundation that Section 508 and EN 301 549 build on.
Testing combines automated and manual checks. BrowserStack automated scans cover 16 pages and last ran on 17 June 2026, and manual keyboard and screen reader checks sit alongside them. Both are rerun after significant releases.
Accessibility is shared, though. Your team owns the content it publishes, your brand colours, any embedded media and the ATS application forms, so editors need training and a simple review step.
See the most accessible careers websites and read our guide to a careers website accessibility audit.
Security review checklist
Use this with any provider. Tick each item once you have it in writing. Nothing leaves your browser.
Careers website security review checklist
Tick each item once you have the evidence.
| # | Check |
|---|---|
| 1 | SOC 2 Type 2 report requested, under NDA |
| 2 | ISO 27001 certificate number checked with the certifying body |
| 3 | Certificate dates and scope confirmed in writing |
| 4 | Penetration test summary and remediation status requested |
| 5 | Hosting regions and data residency confirmed |
| 6 | Roles confirmed: who is controller and who is processor |
| 7 | Sub-processor list and data processing agreement reviewed |
| 8 | What candidate data is stored, and where, confirmed |
| 9 | Accessibility conformance report requested, with its date and level |
| 10 | Responsibility for customer content and third-party scripts agreed |
| 11 | Availability commitment and service credits reviewed |
| 12 | Recovery objectives and incident process reviewed |
This is the printable version. Switch on JavaScript to use the live calculator in your browser.
How this fits your wider evaluation
Security is one lens. Build it into the whole decision using the careers website RFP template, which includes security and accessibility questions you can score. Compare the full cost with what a careers website costs, and if you are moving, use the switching guide to plan the handover.
For how editing works day to day, see the careers website CMS and the wider Happydance platform. Our support and service page explains what happens after launch, and the careers website integrations hub shows how we connect to your ATS. If you hire in a regulated sector, see financial services and healthcare and life sciences careers websites.
Is Happydance SOC 2 compliant?
Happydance has a SOC 2 Type 2 report by A-LIGN covering Security and Availability. It is shared with customers under NDA, and the next audit period runs from 1 July to 31 December 2026. See the security page.
Is Happydance ISO 27001 certified?
Yes. Happydance is certified to ISO/IEC 27001:2022 by BSI, covering the whole careers website platform. The certificate number is on the security page.
Where is the data hosted?
Each customer chooses US, UK or EU on the Order Form. Data is held in Central US, UK South or Germany West Central respectively, in the customer's own database, with Cloudflare in front for a web application firewall, DDoS protection and TLS.
Is Happydance GDPR compliant?
Happydance acts as a processor under a data processing agreement, with a published sub-processor list. Both are in the legal documents.
Does Happydance store candidate applications?
It depends on how applying is set up. The easy-apply overlay passes the application to your ATS without Happydance storing it. Redirects and embedded ATS forms take the candidate to the ATS to apply. Where Job Alerts is enabled, we store the subscriber's email address, search criteria and language.
Is candidate data used to train AI?
No. AI features are inference only and customer and candidate data is not used for training. Messages sent in conversational search go to OpenAI and are retained for up to 30 days for abuse monitoring.
Are Happydance careers websites WCAG compliant?
Our Accessibility Conformance Report (VPAT 2026-06, dated 17 June 2026) records that they support WCAG 2.1 Level AA. It is available on request. Content, brand colours, embedded media and ATS application forms are the customer's responsibility.
What uptime does Happydance commit to?
The SLA commits to 99.9% availability for Elite support and 95% for Standard support, with service credits of 10% of the monthly fee for the downtime period. Live status is at status.happydance.love.
What are the recovery objectives?
A recovery time objective of 12 hours and a recovery point objective of 12 hours, including for the CMS.
What should I ask any careers website provider about security?
Ask for the SOC 2 report, the ISO certificate and scope, the penetration test summary, hosting regions, the DPA and sub-processors, and the accessibility report. Use the checklist on this page.
Start your security review with us
Book a demo and bring your security questionnaire.
Book a demoContact us