Trust Center

    Security and privacy,
    stated plainly

    Interviews contain personal data. This page explains exactly how we protect it, who processes it, what we will and will not do with it, and how to reach us.

    How we protect your data

    Encryption in transit and at rest

    All traffic between candidates, your team, and InterviewCandy is encrypted with TLS 1.2+. Interview recordings, transcripts, and scorecards are encrypted at rest by our cloud providers.

    Access control

    Customer workspaces are logically isolated. Access to production systems is limited to named engineers, protected by multi-factor authentication, and reviewed regularly.

    Hardened cloud infrastructure

    InterviewCandy runs on SOC 2 and ISO 27001 certified cloud infrastructure providers. We do not operate our own data centers.

    Retention and deletion

    You own your candidate data. Interview recordings and transcripts can be deleted from the workspace at any time, and we honor deletion requests for your account and its candidates.

    Candidate transparency

    Candidates are told before the interview starts that they are speaking with an AI, that the session is recorded, and, where enabled, that integrity monitoring is active.

    No training on your data

    Your interview content is used to run and score your interviews. We do not sell candidate data and we do not use your interviews to train foundation models.

    Compliance status

    We would rather tell you exactly where we are than imply certifications we do not hold yet.

    ItemStatus
    GDPR & CCPASupported
    Data Processing AgreementAvailable on request
    Security questionnairesSupported
    SOC 2 reportNot yet available
    Penetration testingAsk us

    Sub-processors

    We use a small number of infrastructure providers to deliver the service. Each is bound by data processing terms. A detailed, current list is available on request.

    • Supabase
      Application database, authentication, and storage
      United States
    • Vercel
      Web hosting and content delivery
      United States (global CDN)
    • AI model and speech providers
      Real-time conversation, transcription, and scoring
      United States

    Responsible AI

    Security is only half of trust in hiring software. How the AI evaluates people matters just as much. Our AI fairness and compliance page covers bias controls, human review, candidate consent, and how we support customers under NYC Local Law 144, the EU AI Act, and state AI hiring laws.

    Contact our security team

    Security questions, questionnaires, DPAs, and vulnerability reports: security@interviewcandy.com. Privacy and deletion requests: support@interviewcandy.com. See also our Privacy Policy.

    Security FAQ

    Need a questionnaire completed?

    Send us your vendor security questionnaire or DPA and we will turn it around quickly, or start a trial and evaluate the product first.