Enterprise-level security, by default
Your model stays isolated, your data is never shared externally, and every answer can be traced back to its source. Here is what that means in practice.
Security & compliance
- SOC 2Audit in progressEcho's SOC 2 audit is underway and expected to complete this quarter. Use the contact form at the end of this page to ask for our current security practices, questionnaire answers or a DPA.
Six questions your IT team will ask
Each of the guarantees on our homepage, expanded into the practices behind it.
Data isolation
Your model is yours. It is never pooled with another customer's data, and no other customer's model is trained on yours.
- Each organization runs against its own isolated model instance
- Your content is never used to train a model another customer can query
- Agent context is scoped to the workspace that owns it — one customer's ATS records never enter another's prompts
- Deleting your workspace removes the context that model was working from
Data handling
Echo acts as a data processor on your behalf. Your organization stays the data controller, and processing happens only on your instructions.
- Processing is limited to the purposes you define when you connect a system
- Echo does not sell, rent or share personal data with third parties for advertising or marketing
- Echo does not collect browsing history or monitor activity outside the actions you take in the product
- Data is retained while your account is active; after account deletion, personal data is removed within 30 days unless the law requires otherwise
- You can access, correct, export or request deletion of your data at any time
Access and authentication
People reach Echo through authenticated accounts, and Echo staff reach your data only when operating the service requires it.
- Every session is tied to an authenticated Echo account
- Agents run only where you switch them on — nothing activates itself
- Internal access is limited to authorized Echo personnel and only for operational needs such as maintenance, technical support and service improvement
- Access controls and regular security reviews are part of how the platform is operated, not a one-off exercise
Infrastructure and hosting
Echo runs on managed cloud infrastructure, with encryption in transit on every request between your browser and our backend.
- All data transmission is encrypted using industry-standard protocols
- Hosting and infrastructure providers process data on Echo's behalf under confidentiality and security obligations
- Technical and organizational measures protect data against unauthorized access, alteration and disclosure
- Data the browser extension keeps locally follows the browser's own security model and can be cleared by the user at any time
AI reliability
Zero hallucinations is an engineering claim, not a slogan. Echo's proprietary ML and AI algorithms are built so an answer can always be traced back to something real.
- Every candidate match carries a transparent score you can inspect, never an unexplained ranking
- Sources and relationship history travel with the insight, so your team can defend what it presents to a client
- Gaps and missing skills are surfaced rather than filled in with a guess
- Where Echo does not have the context, it says so instead of inventing a candidate, a skill or a number
Integrations security
Echo sits on top of the ATS and CRM you already run. Those connections are opened by you and stay under your control.
- Connections are authorized by your organization and can be revoked from your side at any time
- Echo reads the context an agent needs from the connected system — it does not replicate your ATS or CRM into a second product of record
- Each connected system is scoped to the workspace that authorized it
- Turning an integration off stops the agents that depend on it
Read the terms before you sign them
The privacy policy describes what Echo processes, on what legal basis and for how long. The terms of use cover the commercial relationship, including refunds.
Bring your security questionnaire
We will walk through it with the people who built the platform, not a form-filling team.