Security Overview

One page for your security and procurement review. Longer answers, a signed DPA, or a completed questionnaire are available on request at [security email].

What the system never does

• Never makes a decision about a candidate. No score, no auto-reject, no ranking. Observations are plain sentences with the rule that produced them; a named human reviewer records every decision.
• Never sends face images off the candidate's device. Eye and head tracking runs in the browser from models we host; only summary numbers are transmitted.
• Never collects outside the interview tab. No keyloggers, no screen capture without the candidate's own share action, no access to other apps or files.
• Never shares candidate data between customers, or with us for research, without the candidate's separate opt-in.

Encryption

• In transit: TLS 1.2 or higher on every connection, including WebRTC media (DTLS-SRTP).
• At rest: encrypted database (Neon) and encrypted object storage (Cloudflare R2).
• Candidate email: additionally encrypted at the application layer (AES-256-GCM) with a key held only in the hosting secret manager; decrypted only to send invites and reminders.

Access control

• Every request is scoped to the caller's organization; a session, recording or evidence pack can only be read by members of the organization that owns it.
• Roles: interviewer, reviewer, administrator. Observers cannot run checks; an interviewer cannot confirm their own flags; the two-reviewer rule (on by default for Growth and above) requires two decisions before an evidence pack can be exported.
• Recordings are private. Playback and download use signed URLs that expire after 15 minutes and are issued only after the organization check.
• Audit log: every view, download and export of a recording or evidence pack is written with user, time and origin, and printed at the end of each evidence pack.
• TrueCandidate staff access (support, impersonation) is limited to named accounts, logged in the same audit log, and used only with the customer's request.

Integrity of the evidence

• Telemetry from the candidate's browser is signed with a per-session token and verified server-side (identity and room must match); samples with a clock more than a few minutes off are rejected; rate limits prevent floods.
• Rules are versioned (rules@2026.10.2). The version is pinned on every evidence pack, and the rule id is printed next to every observation, so a reviewer can always see which logic produced it.
• Recordings are written by the video provider directly into storage; the application only reads them.

Retention and deletion

• Customers set a retention period between 7 and 90 days (default 30). A nightly job deletes the recording, browser signals and boards for every interview past its date.
• Candidates can request a human re-review from the page after the call; an open request freezes deletion until it is closed.
• Erase on demand: an interview can be erased immediately by the customer; the job removes storage objects and database rows and leaves a tombstone.
• Account closure: data deleted within 30 days, except invoices.

Infrastructure

• Hosted on Railway (US East) with a health-checked, single-image deployment and one-click rollback.
• Video on LiveKit Cloud (US), recordings in Cloudflare R2 (US), database on Neon (US) with point-in-time recovery.
• Face-tracking models and WebAssembly are served from truecandidate.io, so the candidate's browser makes no third-party requests during the interview.
• Secrets live in the hosting provider's secret manager; nothing sensitive is in code or container images.
• Error monitoring (Sentry) and health checks; failures in recording, webhooks or scheduled jobs alert the operator.

People and process

• Solo-operated at this stage, with named super-administrator access and no shared accounts.
• Dependencies are pinned and updated monthly; security patches sooner.
• A breach affecting your data is notified within 72 hours of discovery with the facts needed for your own notifications.
• Full list of providers on the sub-processor page; contractual terms in the DPA.

What we do not have yet

No SOC 2 report or ISO 27001 certificate. We will say so plainly rather than imply otherwise, and we can complete your security questionnaire with the controls above.