Cedar
Cedar is your most intelligent Talent Partner who automates everything for your hiring needs. The system streamlines the hiring process by helping managers create job descriptions, automatically scanning their professional networks for qualified candidates, and most importantly, facilitating warm introductions through existing connections. It uses a primarily Slack-based interface where hiring managers can receive daily candidate suggestions and provide simple feedback through thumbs up/down reactions. When a candidate is approved, Cedar automatically prepares appropriate outreach messages based on the candidate's network tier, orchestrating the warm introduction process through the most relevant connection path.
AI outputs may be inaccurate and should be human-reviewed.
AI outputs may be inaccurate and should be human-reviewed.
Cedar will be able to view:
Cedar will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
Cedar AI Agents Inc.
Company headquarters location
Canada
Terms of service
Privacy & data governance
Data retention policy
Cedar retains customer data only as long as necessary to provide the service, and deletes it on a defined schedule after the engagement ends.
- During use: Data received through the Slack integration — workspace identity (name and Slack handle) and the content a user shares with Cedar — is retained only as long as needed to operate the service for that customer.
- Channel lists are not stored. Cedar reads channel membership at the moment of an action (e.g., inviting a channel's members to the web app) but does not persist the channel list.
- Deletion on termination: All customer data is deleted within 30 days of termination of the engagement, with written certification of deletion available on request.
- Customer-initiated deletion: Customers, and individual employees, can delete their data at any time through the product.
- Encryption & isolation: Data is stored on Google Cloud (us-west1) in a private VPC, encrypted at rest (AES-256) and in transit (TLS 1.2+), and logically segregated per customer.
- Audit logs are retained for 400 days.
- Voice: call audio is not stored; only the resulting transcript is retained.
This policy is maintained under Cedar's SOC 2 Type II program and is reflected in our Data Processing Addendum and Security & Compliance Overview.
Data archiving and removal policy
Cedar does not maintain a separate long-term archive of customer data. Data is retained live only while needed to provide the service, then removed on a defined schedule.
- Removal on termination: All customer data is deleted within 30 days of termination of the engagement. Written certification of deletion, signed by a Cedar officer, is available on request.
- On-request / self-service removal: Customers can delete their data through the product at any time, and individual employees can likewise delete their own data. Cedar honors deletion requests as soon as reasonably practicable.
- Permanence: Removal is a permanent destruction of the data from Cedar's production systems not a reversible archive or a soft-hide.
- Channel lists are never archived — Cedar reads channel membership only at the moment of an action and does not persist it.
- Audit logs are retained for 400 days, then removed.
- Voice: call audio is never archived — it is not stored at all; only the transcript is retained, and it is removed on the same schedule as other customer data.
- Scope note: Cedar's factual professional-history layer ("who has worked where"), built solely from public and licensed data, is Cedar's own work product rather than customer content, and is governed separately from customer-data removal.
Maintained under Cedar's SOC 2 Type II program and reflected in our Data Processing Addendum and Security & Compliance Overview.
Data storage policy
All customer data is stored in the United States on Google Cloud Platform (region us-west1). Cedar is fully cloud-hosted with no on-premise infrastructure; physical security of the underlying data centers is provided by Google Cloud under its shared-responsibility model.
- Storage: Customer data is held in an encrypted PostgreSQL database within a private VPC. Secrets are held in Google Cloud Secret Manager.
- Encryption: AES-256 at rest and TLS 1.2+ in transit; SSL is required on all production database connections.
- Access control: The production database is reachable only within a private VPC via an IAM-authenticated bastion host. MFA is enforced on privileged accounts, and access follows least-privilege principles.
- Tenant isolation: Customer data is logically segregated per customer, and access is scoped and enforced at the application authorization layer, so one customer's data
is never accessible to another.
- Voice: call audio is not stored; only the resulting transcript is retained.
Maintained under Cedar's SOC 2 Type II program and reflected in our Data Processing Addendum and Security & Compliance Overview.
Data center location(s)
United States
Data hosting details
Cloud SQL and Hosted Neo4j in Google Cloud Platform
Data hosting company
Google Cloud Platform
App/service has sub-processors
no
App/service uses large language models (LLM)
yes
LLM model(s) used
Anthropic Claude, OpenAI, and Google Gemini
LLM retention settings
Cedar does not enable any model-training or data-sharing setting with its LLM providers, and no customer data is used to train or improve any model.
LLM data tenancy policy
Cedar uses large language models only to process data in real time for the customer whose request is being served. Customer data is never used to train or fine-tune models and is not commingled across customers at the model layer.
LLM data residency policy
All of Cedar's infrastructure and data storage is located in the United States (Google Cloud Platform, region us-west1), and LLM processing takes place in the United States.
Certifications & compliance
Data deletion request procedure
Cedar handles deletion requests through a defined intake → verify → execute → confirm process:
1. Intake. Requests can be submitted (a) by customers or data subjects to privacy@getcedar.ai, or (b) directly in the product — individual employees can delete their own data at any time, and customer administrators can delete data through the product's functionality.
2. Verification. Cedar verifies the requester's identity and authority before acting. A request concerning an individual whose data Cedar processes on a customer's behalf is coordinated with that customer (the data controller), consistent with our DPA.
3. Execution. Approved requests result in permanent deletion of the relevant data from Cedar's production systems — not a reversible archive. Cedar completes deletion as soon as reasonably practicable.
4. Termination. On termination of the engagement, all customer data is deleted within 30 days, with written certification of deletion (signed by a Cedar officer) available on request.
5. Confirmation. Cedar confirms completion to the requester, and provides certification where requested.
Maintained under Cedar's SOC 2 Type II program and reflected in our DPA and Security & Compliance Overview.
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Date of latest pen test
2026-08-03
Executive summary is available to potential customers upon request
yes
Supports Single Sign On (SSO) with the following providers
Okta
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
privacy@getcedar.ai
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
no
Requires third party authorization/connections
yes
Uses token rotation
no