1. Access and keys
API keys are issued to verified organisations and belong to the organisation, not to an individual. Keep them secret, use them only from servers you control, and revoke them as soon as you suspect they have leaked. You are responsible for all activity made with your keys. We may revoke keys or limit access to protect people, the platform or the law.
2. Candidate data
- Use candidate data only to run hiring for the posting the candidate applied to, and only as the candidate allowed. Don't try to re-identify masked candidates, combine data to build profiles, sell or share data with third parties, or use it to train models.
- Respect withdrawals and deletion: when a candidate withdraws or deletes their account, delete their data from your systems within 30 days, unless the law requires you to keep it.
- You act as an independent controller (or as required by local law) for data you copy into your systems. Keep it secure and follow applicable data-protection law (for example the DPDP Act 2023 in India and the GDPR in the EU).
- Never use the API for discrimination. Don't filter or rank candidates on protected characteristics.
3. Fair use
Stay within the published rate limits. Don't scrape, probe for vulnerabilities, or get around limits, masks or consent controls. Abuse is reported to Trust & Safety and can lead to suspension of keys or of the organisation.
4. Embeds and branding
Show embeds as delivered. Don't hide the “Powered by One-Career” line or change grades, verification marks or job details. Don't imply that One-Career endorses you beyond what the verified marks show.
5. Changes and availability
6. Security reports
Report vulnerabilities to security@one-career.com. Please give us reasonable time to fix them before you disclose anything.