Security & compliance
Built for the day someone asks “why?”
Isolation, fairness and accountability as properties of the system — not promises in a policy.
GDPR
Data Processing Agreement with Standard Contractual Clauses, EU / UK privacy notices, a public subprocessor list and data-rights handling.
Read the DPAIndia DPDP Act
An India-specific privacy notice and consent records, written for the Digital Personal Data Protection Act.
India privacy noticeUS state privacy
CCPA / CPRA-aligned notices for candidates and customers in the United States.
US privacy noticeSOC 2 ready
Controls aligned to SOC 2 principles — tenant isolation, encryption, access control, audit logging. Formal attestation is on the roadmap; the security questionnaire is available today.
Request the questionnaireFair AI by design
Candidates are anonymised before any model sees them, no protected traits are inferred, and every score stores its provenance. Scoring has been reviewed for bias.
Candidate noticeSOC 2 and ISO 27001 are not yet formally attested — controls are aligned and attestation is on the roadmap. Ask us for the current security questionnaire and data-processing terms.
In the product
Properties of the system, not promises in a policy.
Tenant isolation
Every row carries your organisation’s id; every query is scoped to it. One workspace can never read another’s candidates.
Encryption
TLS end to end. Settings and tokens encrypted at rest.
Sign-in
Google and Microsoft SSO, or email and password with policy controls. Neither path can lock the other out.
The operator console
TOTP multi-factor, backup codes, IP allowlist, password expiry, session limits. Every action audited.
Fair AI by construction
Anonymised before any model sees it. No inference on protected traits or emotion. Provenance on every score.
Candidate-side safety
Single-purpose expiring links. Proctoring in the browser; audio transcripts never leave it.
Data handling
Where your data lives, and doesn’t.
Where video happens
In your own Microsoft 365 or Google Workspace. Recordings are fetched only with admin consent.
What we store
Parsed résumé data, scores with provenance, transcripts you keep, pipeline history — all scoped to you.
What we don’t
Card details, raw proctoring video, or any inference about a candidate’s emotional state.
Procurement asking questions?
The current security questionnaire and data-processing terms, by return mail.