9-Dimension Security Framework
Identity & Access Management
Compliance & Certification
AI Integration Security
NEWAPI Security
Infrastructure Security
Data Protection
Vulnerability Management
Breach History
Incident Response
AI Integration Security Assessment (9th Dimension)
Assess whether SaaS applications are safe for AI agent integration using Anthropic's Model Context Protocol (MCP) standards. Identify Shadow AI risks before they become breaches and make safer AI tool decisions than your competitors.
Last updated: January 17, 2026 at 05:28 PM
Assessment Transparency
See exactly what data backs this security assessment
Data Coverage
3/8 security categories assessed
Score based on 3 of 8 categories. Missing categories could not be assessed due to lack of public data or vendor restrictions.
Evaluation Friction
Evaluation friction estimates how long it typically takes to fully evaluate this vendor's security practices, from initial contact to complete assessment.
Security Documentation
These documents were discovered during automated assessment and may contain additional security information not reflected in the score.
Transparency indicators show data completeness and vendor accessibility
AI Integration Security
🔒 9th DimensionAssess whether Greenhouse is safe for AI agent integration. Identify Shadow AI risks before they become breaches using Anthropic's Model Context Protocol (MCP) standards.
AI Readiness
Infrastructure for AI integration
AI Security
Safety controls for AI agents
Comprehensive Security Analysis
In-depth assessment with detailed recommendations
Security Analysis
Executive Summary
| Metric | Value | Assessment |
|---|---|---|
| Security Grade | B+ | Needs Improvement |
| Risk Level | Medium-High | Executive approval required |
| Enterprise Readiness | 54% | Gaps Exist |
| Critical Gaps | 0 | None |
Security Assessment
| Category | Score | Status | Action Required |
|---|---|---|---|
| 🟢 Breach History | 100/100 | excellent | Maintain current controls |
| 🟡 Vulnerability Management | 85/100 | good | Maintain current controls |
| 🟡 API Security | 80/100 | good | Maintain current controls |
| 🟠 Compliance & Certification | 60/100 | needs_improvement | Monitor and improve gradually |
| 🟠 Data Protection | 60/100 | needs_improvement | Monitor and improve gradually |
| 🟠 Incident Response | 60/100 | needs_improvement | Monitor and improve gradually |
| 🟠 Infrastructure Security | 50/100 | needs_improvement | Review and enhance controls |
| 🟠 Identity & Access Management | 45/100 | needs_improvement | Review and enhance controls |
Overall Grade: B+ (59/100)
Critical Security Gaps
| Gap | Severity | Business Impact | Recommendation |
|---|---|---|---|
| 🟡 No public security documentation or audit reports | MEDIUM | 40-80 hours of security assessment overhead | Request security audit reports (SOC 2, pen tests) and security whitepaper |
Total Gaps Identified: 1 | Critical/High Priority: 0
Compliance Status
| Framework | Status | Priority |
|---|---|---|
| SOC 2 | ❌ Missing | High Priority |
| ISO 27001 | ❌ Missing | High Priority |
| GDPR | ❌ Missing | High Priority |
| HIPAA | ❓ Unknown | Verify Status |
| PCI DSS | ❓ Unknown | Verify Status |
Warning: No compliance certifications verified. Extensive due diligence required.
Operational Excellence
| Metric | Status | Details |
|---|---|---|
| Status Page | ❌ Not Found | N/A |
| Documentation Quality | ❌ 0/10 | No SDKs |
| SLA Commitment | ❌ None | No public SLA |
| API Versioning | ⚠️ None | No version control |
| Support Channels | ℹ️ 0 channels |
Operational Facts Extracted: 2 data points from operational_maturity enrichment
Integration Requirements
| Aspect | Details | Notes |
|---|---|---|
| Setup Time | 3-5 days (manual setup required) | Estimated deployment timeline |
| Known Issues | Manual user provisioning may be required, Limited API automation capabilities, No automated user lifecycle management, Additional security controls needed | Implementation considerations |
⚠️ Inherent Risk Consideration
Data Sensitivity: This application stores sensitive data:
Risk Level: LOW - Contains
Compliance & Certifications
AI Integration Security Assessment
Industry-first assessment evaluating whether Greenhouse is safe and ready for AI agent integration. Covers AI security controls and readiness infrastructure for Anthropic's Model Context Protocol (MCP).
AI Integration Security
Industry-first assessment for AI agent safety
✅Excellent Security Features
- ●Required Scopes: Which specific data permissions does your integration need (e.g., harvest:job_posts:list, harvest:candidates:list)? See Harvest API documentation for available scopes.
- ●Access Token: 1 hour (Used to make API calls). Refresh Token: 24 hours (Used to get new access tokens). Authorization Code: 1 minute (Must be exchanged quickly!)
- ●When editing an API Credential, you will be able to manually rotate secrets. After rotation, old secrets will be available for up to 1 week. You can delete the old secret ahead of the scheduled deletion if desired.
- ●Managing permissions using a Harvest API key allows you to permit or deny access to each Harvest endpoint individually, so you can have more control over what data a developer or third-party partner can access.
- ●Harvest API includes GET, POST, PUT, PATCH, and DELETE endpoints across: Activity Feed, Applications, Approvals, Candidates, Close Reasons, Custom Fields, Demographic Data, Departments, Education, EEOC, Email Templates, Job Openings, Job Posts - with individual endpoint permissions configurable.
- ●We recommend granting each key only the exact access it requires. You may need to work with your internal development team or the integration to determine which permissions are needed.
- ●Audit log offers a record of important events from the prior thirty days, providing insights to who accessed or edited information in Greenhouse Recruiting. Use audit log to empower your teams to detect and minimize the impact of incidents when they occur, scrutinize configuration edits, and ensure sensitive data is only accessed by the people who truly need it.
- ●Audit log API requests are limited to 50 per 10 seconds, as specified in the returned X-RateLimit-Limit header. Paginated requests are limited to 3 per 30 seconds. Check the X-RateLimit-Limit and X-RateLimit-Remaining headers to see how many more requests are permitted until throttling kicks in.
- ●A webhook is a simple event-notification system. When an event occurs in Greenhouse, a payload of JSON data containing information about the event is sent via POST to a specified endpoint URL over HTTPS. Each delivery will include a Greenhouse-Event-ID header.
- ●Short-lived access tokens (1 hour) with 24-hour refresh tokens
⚠️Security Gaps & Recommendations
- ●No mfa enforcement
- ●No ai attribution
- ●No MFA enforcement for API access documented
- ●No explicit AI training data opt-out mechanism
- ●No AI-specific request tagging for audit trails
AI Integration Security evaluates whether Greenhouse is safe for AI agent access. This assessment considers authentication strength, access controls, observability capabilities, and data privacy protections when APIs are accessed by AI systems like Claude Code, GitHub Copilot, or custom AI agents.
AI Readiness Assessment
Evaluates readiness for AI agent integration
Official or community MCP server support
API docs, SDKs, code examples
API reference, auth flows, error handling
MCP Server Available
communityGreenhouse supports Anthropic's Model Context Protocol (MCP) for secure AI agent integration.
💡Recommendations
- →❌ Poor AI readiness - not recommended for AI workflows
AI Readiness measures whether Greenhouseprovides the infrastructure and developer resources necessary for secure AI agent integration. High readiness indicates official MCP server support, comprehensive API documentation, and developer-friendly tools.
API Intelligence
Production-ready code examples for security operations, extracted from official Greenhouse API documentation using LLM analysis. Copy and paste these examples directly into your automation workflows.
API Intelligence
API intelligence structure found but no operations extracted. May require manual review.
Incomplete API Intelligence
Our automated extraction found API documentation but couldn't extract specific operations. This may require manual review or vendor assistance.
View Vendor DocumentationAI-Powered Stakeholder Decision Analysis
LLM-generated security perspectives tailored to CISO, CFO, CTO, and Legal stakeholder needs. All analysis is grounded in verified API data with zero fabrication.
Security Posture & Operational Capabilities
Comprehensive assessment of Greenhouse's security posture, operational maturity, authentication capabilities, security automation APIs, and breach intelligence.
Operational Data Not Yet Assessed
We haven't collected operational maturity data for Greenhouse yet.
Security Automation APIs
Programmatic user management, data operations, and security controls
Frequently Asked Questions
Common questions about Greenhouse
We designed our open APIs to let our customers and partners access and update data from Greenhouse. Our goal? To accommodate any type of hiring workflows with easy integration access to our tools or others that exist in the marketplace today.
Source: Search insights from Google, Bing
Harvest API can be used to build integrations that programmatically create or update candidate, job, and organization information. Harvest API is designed to export candidate, job, and organization information from Greenhouse Recruiting via GET endpoints.
Source: Search insights from Google, Bing