Security, taken seriously from day one

Data encryption

All data is encrypted in transit (TLS) between your browser, our servers, and our database. Data at rest is encrypted by our infrastructure providers (Supabase/PostgreSQL, Backblaze B2).

Row Level Security

Postgres Row Level Security (RLS) is enabled on every table in the database. Every query is scoped to the requesting organization at the database layer, not just in application code — one org's data cannot be read by another, even if application logic has a bug.

Role-based access control

Access is governed by role (Owner, Admin, HR Manager, Interviewer, Viewer) and enforced both at the API layer, on every endpoint, and in the UI. Panelists, for example, can never see other panelists' feedback or the aggregate hiring decision — this is enforced server-side, not just hidden in the interface.

Rate limiting

All API endpoints are rate-limited, with tighter limits on sensitive actions (authentication, invites, file uploads) to reduce abuse and brute-force risk.

File upload validation

Uploaded files (résumés, offer letters, logos) are validated for file type and size before being accepted. Files are stored in private object storage and served only via short-lived, signed URLs — never as public links.

SOC 2

In progress. We're an early-stage company and haven't completed a SOC 2 audit yet — we're not going to claim otherwise. It's on our roadmap as we grow.

Data hosting

Application data is hosted on Supabase's managed PostgreSQL infrastructure. File storage (résumés, offer letters, and other documents) is hosted with Backblaze B2 in the United States.