FinowlEmail breach checks · HR and recruiting
Email breach checks for HR and recruiting platforms
HR platforms sit on personal data that attackers value, and many of the people logging in reuse email and password combinations from other services. Checking an address against Finowl Intelligence shows whether it appears in known breaches and which data classes leaked. For recruiters and HR administrators, an exposed address with leaked passwords is a strong reason to require two-factor authentication before they can open candidate pools or payroll settings.
For employees using self-service portals, the same check can gate sensitive changes. Before someone updates direct deposit details, a breached email combined with a new device can trigger extra verification through a channel the company already trusts. The check is about protecting the account, not judging the person, so it should never affect hiring outcomes, performance reviews or eligibility for any role.
USE CASES
Where it fits in hr and recruiting
Recruiter seat provisioning
When a new recruiter or agency partner is added to your applicant tracking system, check their work email and require two-factor setup if it appears in breaches that exposed passwords.
Direct deposit change protection
Before an employee changes bank details in a self-service portal, combine a breached-email signal with device and session data to decide whether to require an additional verification step.
Career site abuse filtering
Use breach status alongside rate and behavior signals to spot scripted candidate account creation, routing suspicious signups to email verification rather than rejecting them outright.
Security review for HR admins
Periodically check the addresses of HR administrators who can export records, and prompt a credential rotation when an address shows exposure that was added since the last review.
HOW TO INTEGRATE
The workflow
- 1
Store FINOWL_API_KEY in your HR platform's secret manager and call Finowl only from backend services.
- 2
Call POST /v1/breaches/email when a privileged role is granted and before sensitive self-service changes.
- 3
Evaluate breached, DataClasses and BreachDate to decide whether to require two-factor or step-up verification.
- 4
Keep breach results out of candidate profiles and hiring records so they cannot influence employment decisions.
- 5
Handle 429 responses by waiting for Retry-After and treat 5xx responses as unknown rather than blocking access.
curl https://api.finowl.co/v1/breaches/email \
-H "Authorization: Bearer $FINOWL_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"email": "talent.partner@example.com"
}'Checks a recruiter's work address when they are granted access to a candidate pool. Exposure triggers mandatory two-factor setup; it is never stored on a candidate or employee record.
GOOD PRACTICE
Before you ship
Keep breach results in your security systems only. They must not appear in applicant tracking records, interview notes or anything a hiring manager uses to evaluate a person.
Personal data of candidates and employees is involved, so document breach checks in your privacy notice and retain only the decision you took, not the full breach list.
Phrase messages to employees carefully. A short note explaining that their email appeared in a third-party breach, with clear next steps, avoids confusion and needless alarm.
Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.
A FEW GOOD QUESTIONS
Common questions
More for hr and recruiting
Email breach checks for HR and recruiting platforms
Start with 100 free credits every month and test the request above in the sandbox.