// Trust & Security Report
iCIMS
Enterprise talent acquisition platform: iCIMS Hire (ATS, text recruiting, onboarding, offer management), iCIMS Engage (CRM, employer branding, career sites, chatbot), and Coalesce AI (AI-powered candidate matching, sourcing, and workflow automation).
Certifications held
16
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.icims.com“27701 CERTIFICATIONS AND COMPLIANCE SOC 2 Type 2 CERTIFICATIONS AND COMPLIANCE SOC 3 CERTIFICATIONS AND COMPLIANCE TRUSTe View all documents Risk Profile Data Access Level Impact Level Recovery Time Objec”
Verify on icims.com“'SOC 1 (SSAE 16), SOC 2, and SOC 3 compliant' — listed on the infrastructure overview page.”
Verify on trust.icims.com“CERTIFICATIONS AND COMPLIANCE CSA STAR Level 1 CERTIFICATIONS AND COMPLIANCE ISO/IEC 27001 SoA CERTIFICATIONS AND COMPLIANCE ISO/IEC 27001:2022 CERTIFICATIONS AND COMPLIANCE ISO/IEC 27701 CERTIFICATIONS AND”
Verify on trust.icims.com“The iCIMS 2025 ISO 27001 and 27701 certifications are available on the iCIMS Trust Center.”
Verify on icims.com“(SSAE 16), SOC 2, and SOC 3 compliant ISO 27001, ISO 27017, ISO 27018 certified PCI DSS 3.2 certified GDPR ready Environment, Power & Backup/Failover All locations have the following environment, power and”
Verify on trust.icims.com“Certifications and Compliance APEC PRP CCPA CPRA CSA STAR Level 1 EU-US DPF GDPR ISO/IEC 27001 SoA ISO/IEC 27001:2022 ISO/IEC 27701 Microsoft SSPA SOC 2 Type 2 SOC 3 Swiss-US DPF TRUSTe TX-RAMP”
Verify on icims.com“'iCIMS, Inc. and its subsidiaries iCIMS International, LLC, TextRecruit, Inc., and SkillSurvey, Inc. (collectively, iCIMS U.S. entities) comply with the EU-U.S. Data Privacy Framework (DPF), the UK Extension, and the Swiss-U.S. DPF.'”
Verify on trust.icims.com“(BitSight) REPORTS Security Architecture Diagram CERTIFICATIONS AND COMPLIANCE CSA STAR Level 1 CERTIFICATIONS AND COMPLIANCE ISO/IEC 27001 SoA CERTIFICATIONS AND COMPLIANCE ISO/IEC 27001:2022 CERTIFICATIONS”
Verify on icims.com“'ICIMS earned TrustArc's TRUSTe Responsible AI Certification — the first-ever artificial intelligence certification focused explicitly on data protection and privacy.' Evaluated against validity, explainability, accountability, privacy enhancement, fairness, and security criteria. Certified March 5, 2026.”
Verify on trust.icims.com“TX-RAMP (Texas Risk Assessment Management Program) listed on trust.icims.com.”
Verify on trust.icims.com“Microsoft SSPA (Supplier Security and Privacy Assurance) listed on trust.icims.com.”
Verify on trust.icims.com“APEC PRP (Asia-Pacific Economic Cooperation Privacy Recognition for Processors) listed on trust.icims.com.”
Verify on trust.icims.com“Continuous Integration/Continuous Deployment Data Security View more Reports HIPAA Report Security Architecture Diagram Self-Assessments CAIQ SIG SIG Lite Data Security Access Monitoring Data Backups”
> Show 2 unconfirmed / not-held certifications
source: trust.icims.comFedRAMP is not listed on trust.icims.com. iCIMS was not found in the official FedRAMP marketplace (fedramp.gov/marketplace) as Authorized or In Process. Third-party security profile sites claim 'FedRAMP Compliant' but this appears to be inaccurate — no FedRAMP ATO confirmed on any vendor-domain page.
source: trust.icims.comNo evidence of ISO/IEC 42001 certification on trust.icims.com or any iCIMS page. iCIMS holds TRUSTe Responsible AI instead for AI governance.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
US (Virginia primary, Oregon/Washington failover); EU (Germany primary, Ireland failover); Canada (Quebec primary, Ontario failover). iCIMS Frontline AI hosted in California with Virginia failover.
The iCIMS services privacy notice states: 'We will not use, disclose, sell, review, share, distribute, transfer, or reference any Subscriber Data except as permitted in the Subscription Agreement.' An iCIMS blog post states AI/ML algorithms 'do not use and are not trained with any candidate personal identifiable data.' However, the TRUSTe certification newsroom (March 2026) says the platform 'is uniquely trained on billions of real-world recruiting data points,' and the services privacy notice permits use of 'Public Personal Data for research and development purposes (for example, to test the accuracy of AI algorithms and to determine if AI algorithms produce biased output).' The distinction appears to be that subscriber PII is protected from training, but aggregated or anonymized/public recruiting data is used. Opt-out for SkillSurvey research is available by contacting privacy@icims.com.
// Security controls
Encryption in transit
TLS (standard; trust center confirms defense-in-depth security model with network segmentation)
trust.icims.comInfrastructure
AWS and Microsoft Azure; multi-region with active failover; 99.9% uptime SLA
icims.comPhysical security
Restricted datacenter access, MFA badge entry, video surveillance, intrusion detection, alarm systems, access logging
icims.comApplication security
Penetration testing, static/dynamic code analysis, CI/CD security practices, audit logging documented in trust center
trust.icims.comIncident response
Dedicated security team monitoring and responding to security events; breach notification obligations per privacy notice
icims.comAccess control
SSO, Google/Microsoft OAuth, Okta SAML support; role-based permissions
security-profiles.nudgesecurity.com// Products & data scope
Data it handles: Candidate PII, job application data, offer letters, onboarding documents
Enterprise ATS. Primary product for Fortune 500 clients. Text recruiting and offer management bundled.
Data it handles: Candidate contact data, engagement history, career site interactions
Includes career site builder, recruitment chatbot, and employee testimonial video features.
Data it handles: Job descriptions, resume data, candidate profiles, interview data, engagement metrics
Built on proprietary recruiting data. TRUSTe Responsible AI certified (March 2026). AI/ML stated to not train on candidate PII. Integrates with iCIMS Hire/Engage with no separate integration required.
Data it handles: Reference and background check data; candidate demographic information used for internal research
Acquired product. Subject to separate research data use; opt-out available by contacting privacy@icims.com.
// What to watch
- Third-party security profiles (e.g. Nudge Security) list iCIMS as 'FedRAMP Compliant,' but iCIMS is not found on the official FedRAMP Marketplace (fedramp.gov) as Authorized or In Process, and FedRAMP is absent from trust.icims.com.
- A 'HIPAA Report' document is available in the trust center, but HIPAA is not listed as a certification, no formal BAA confirmation was found on the vendor's public pages, and the iCIMS infrastructure page does not mention HIPAA. Healthcare clients should inquire directly about BAA availability.
- The infrastructure page states 'PCI DSS 3.2 certified', but PCI DSS 3.2 was superseded by version 4.0 in March 2022, and PCI DSS is not listed on trust.icims.com, suggesting the infrastructure page may be out of date. The current PCI DSS compliance version is unconfirmed.
- Marketing materials (TRUSTe certification newsroom, March 2026) state the AI is 'uniquely trained on billions of real-world recruiting data points,' while the services privacy notice and blog claim AI/ML does not train on 'candidate personal identifiable data.' The boundary between aggregated or public recruiting data and subscriber PII is not explicitly drawn in a binding legal document on public pages.
// At a glance
Pricing model
Enterprise subscription (per-seat or volume; specific pricing not publicly disclosed; sales-led)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on iCIMS, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-29. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.icims.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.