Candidate data deserves serious care

How we protect your data

• Data protection

  • TLS for every connection between browsers, our services and vendors.
  • Databases, storage and caches are encrypted at rest with AWS KMS keys.
  • Recordings are served through short-lived, signed links.
  • Backups every day, kept for 7 days, plus weekly snapshots kept for 35 days.

• Access control

  • Role-based permissions for owners, admins, recruiters, hiring managers and viewers.
  • An audit log of sensitive actions such as exports, role changes and erasures.
  • API keys are scoped and can be revoked at any time.
  • Report share links can require a passcode and expire automatically.

• Privacy and data rights

  • Candidates see clear consent before anything is recorded.
  • Each organisation sets how long interview data is kept.
  • Candidate erasure and legal hold are built into the product.
  • A public list of every sub-processor that touches personal data.

• Responsible AI

  • The AI recommends; people make the hiring decision.
  • Every score is tied to the transcript and recording, so it can be checked.
  • Structured rubrics keep every candidate on the same criteria.
  • Each report records the model and prompt version that produced it.

• Application security

  • Strict content security policy and secure headers on every page.
  • Rate limiting on sign-in and public endpoints.
  • Secret scanning, dependency audits and container scans on every change.
  • Signed webhooks and protection against server-side request forgery.

• Reliability

  • Monitoring and alerting across every service, with on-call runbooks.
  • A synthetic interview checks the full flow around the clock.
  • Interviews survive network drops with automatic reconnect.
  • Load-tested before launch, with documented capacity.