Trust

Security and data protection, stated plainly

This page is written for the person with the questionnaire. It leads with what this product does not have, because that is the part you would otherwise spend two weeks finding out, and it says where each answer comes from.

Buyer FAQ What proctoring records

Certifications

No SOC 2 report. No ISO 27001 certificate.This system holds neither, and the same sentence is the first thing the Trust Centre inside the product says. It is stated here because your security team verifies it and would find out anyway, and because an invented certificate is not marketing, it is fraud. If either is a hard requirement in your process, this is the point to stop reading rather than the point to book a call.

What exists instead is specificity. Every control below is a mechanism you can ask about and we can point at, rather than a badge. That is a worse answer than a certificate for a procurement checklist and a better one for actually understanding what happens to your candidates' data.

Faces, voices and other special-category data

Proctoring produces the most sensitive data in hiring software, and the section a European reviewer reads first.

What can be captured, depending on what you switch on:

Screen recordings of the candidate’s shared display during a proctored assessment.
Webcam video recorded during a proctored assessment.
Webcam still frames sent to an AI model for analysis — only where camera analysis is enabled, which is off by default and can only be turned on by an account owner.
Identity-document and selfie images — only where the photo-ID check is enabled.

Biometric data processed to identify a person uniquely is a special category under GDPR Article 9 and needs an Article 9 condition, which in hiring is normally the candidate's explicit consent, collected before capture begins.

A known gap, stated rather than hiddenThis product stores a verbatim consent record — the exact text the candidate saw, with a hash of it, appended rather than updated — for AI interviews. It does not yet store an equivalent per-candidate Article 9 consent artefact for proctoring capture. Candidates are told about proctoring by the assessment flow, but there is no stored artefact that could be produced to a regulator. If your lawful basis for recording rests on consent, that record has to come from your own process today. This is written down inside the product too, on the Trust Centre page every one of your staff can read.

Two design decisions follow from taking that seriously. Camera analysis is off until an account owner — not a delegated administrator — turns it on, because switching it on means sending candidates' faces to a third-party model and nobody should learn afterwards that a colleague enabled it. And every camera finding ships worth zero points, so no candidate is scored down by a model's reading of their face unless your organisation deliberately decides otherwise.

Tenant separation

The failure that matters most in multi-tenant hiring software is one customer reading another customer’s candidates.

The tenant comes from the token, never from the request

There is no customer-facing endpoint in this product that accepts an organisation identifier from the client. It is read from the verified token and applied again inside the service layer, so a mistake in one layer cannot widen a query in the other.

A cross-tenant miss answers 404, not 403

A 403 confirms that the identifier exists, and existence is itself a disclosure. Records belonging to another organisation are simply not there.

Child records are never reached by their own identifier alone

A comment, a file, a clip or a finding is always resolved through its parent under the caller’s organisation first. An identifier taken from somewhere else addresses nothing.

Sittings resolve ownership through the assessment

An assessment sitting carries no organisation of its own, so every route that touches one resolves it through the test that owns it. A session identifier on its own is never enough to authorise a read or a write.

Retention and deletion

Recordings of people are the data class where “we will get to it” becomes a liability.

Retention is a policy you set, per class of data, and the product ships no default window. That is a deliberate choice with an uncomfortable consequence, and the product states it rather than hiding it: anything without a window configured is kept until somebody deletes it. The Trust Centre inside the product prints exactly how many of your data classes have a window and how many do not, so nobody has to guess.

Nothing is ever swept by accident. A retention sweep requires an explicit non-dry-run, a stored policy that is enabled, and records that genuinely exceeded the window. The default of every entry point is to report what it would do.
Recordings are ledgered separately from sittings. Deleting a test cascades in the database and takes the description of its recordings with it, which historically left real footage of real people in storage that nothing in the product could see or attribute. Recording assets are now recorded in a table that is not cascaded, so footage stays attributable — and therefore deletable — after its session is gone.
Erasure reaches storage, in the right order. Media is removed and verified absent before the database rows are touched.

Candidate rights

In almost every deployment you are the controller and this product is the processor: a candidate exercises their rights with you, and the product’s job is to make that possible rather than to answer on your behalf.

Right	How it is served
Access and portability	A machine-readable export of everything held on one person, with time-limited links to their media.
Erasure	Media is deleted from object storage and verified gone before anything in the database is touched — the order matters, because the reverse leaves orphaned recordings nothing can find.
Rectification	Candidate records are editable by the controller, and every change is written to the append-only audit trail.
Objection and human review	Where an AI system was involved, the candidate-facing notice carries a named route to a human. The product refuses to publish a notice that requires one and does not have one.

Erasure is gated three ways, on purposeHanding a stranger somebody else's record, or destroying somebody's record on a stranger's say-so, is itself the breach. So an erasure requires that the identity check on the request has been recorded, that the operator retypes the subject's email address, and that they explicitly say this is not a dry run. Only an account owner can do it, and every step appends to a trail that cannot be edited.

The audit trail, and what it does not prove

Updates, deletes and truncation of the audit table are refused by a database trigger, and each row is hash-chained to the one before it, so a row that was altered or removed through the application is detectable. The product can verify that chain on demand.

The limit, stated in the same breathThis proves nothing was altered or removed through the application. It cannot prove anything about somebody with direct ownership of the database. Any vendor whose audit claim does not carry that caveat has not thought about it, or is hoping you will not.

Access control

Single sign-on

OIDC and SAML per organisation, with the option to require it. Only an account owner may configure it, because that setting decides whether the organisation can still reach its own account.

Directory deprovisioning

SCIM 2.0. A directory that marks somebody inactive kills every access and refresh token they hold on their next request, rather than whenever their session would have expired. Only the hash of a provisioning token is stored, so a copy of the database does not hand over a working credential.

Delegated administration

Administrators, sub-administrators with per-module permissions, and interviewers. The operations that mint credentials or change commercial terms require the account owner’s own role, not a delegated one.

API keys

Read-only by default and scoped to specific resources. Only an account owner can create one, because a key outlives sessions and ignores menu-level permissions.

Candidates are deliberately not directory identities. They live in the same user table but a corporate directory sync can neither enumerate nor deactivate them — they are the subject matter of the product rather than its operators, and letting a customer's identity provider reach them would be both wrong and surprising.

Other companies that touch this data

Your reviewer will call them sub-processors.

The list is generated from how the running system is actually configured rather than typed out from memory, because a supplier list that has drifted from what the software really calls is worse than no list at all. It is printed in the Trust Centre inside the product, with what each supplier is used for and what data reaches them, and it is the version to quote in a questionnaire.

Encryption in transit is TLS between the browser, the edge and the API, and between the API and the database. Encryption at rest is a property of the managed database and object storage platform. Passwords are hashed by the authentication service and provisioning tokens are stored only as hashes; there is no additional field-level encryption of candidate data beyond the platform's own at-rest encryption. Each of those has a different basis — some verified from this system, some documented by a supplier — and the Trust Centre labels which is which rather than presenting them as one confident block.

Ask, and you get a yes or a noData residency, key management, penetration testing, incident history: where the answer is good you will get the specifics, and where there is not one you will get told that instead of a paragraph that sounds like an answer. That is the whole posture of this page.

SOC 2 / ISO 27001: Neither; Stated first, here and inside the product.
Audit table: Append-only; Hash-chained rows; updates and deletes refused by the database itself.
Retention default: None shipped; You set the window per data class. Anything unset is kept until deleted.
Camera analysis: Off by default; Account owner only, and every finding worth zero points.

Elsewhere on this site

Pricing

The plan ladder, what one assessment means as a billing unit, and how a plan actually gets set today.

Buyer FAQ

GDPR, retention, appeals, dropped connections, and what happens when the evidence is inconclusive.

Proctoring and integrity evidence

What a sitting records, what raises a finding, what each finding is worth, and the signals this product deliberately refuses to score.

Session replay

Scrub the whole sitting with the evidence laid over the same timeline — including the findings the guards cleared.

Send the questionnaire

Every question on it gets a specific answer or an admission that there is not one yet. The Trust Centre inside the product prints the live configuration — supplier list, retention schedule, audit-chain verification — and it is the document to quote from.

Get started free Buyer FAQ