Security overview

• All traffic uses TLS. The database and recording storage are encrypted at rest by our hosting providers.
• Interview recordings are reachable only through the report and client-link APIs — by a signed-in member of the owning agency or through a client link the agency enabled. Recordings stored by Recruit100x are served through signed links that expire in minutes; recordings kept by the voice provider are fetched from the provider on request.
• Candidate personal data never enters product analytics (a validator rejects it at capture), and error monitoring excludes candidate content.

Every database query is scoped to the agency by guard code, and an isolation test suite — which tries to read and change another agency’s data through every API route — runs as a release gate. Cross-agency lookups return “not found”, never a permission error, so nothing about another agency’s data is revealed.

• Invitation and client-report links use 128-bit random tokens. Only a hash of each token is stored, and comparisons are constant-time.
• Invitation links expire on the date the agency chooses; reminders rotate the token. Client links expire on a chosen date (at most 90 days) and can be revoked at any time.
• Invalid, expired and revoked links all show the same generic page — nothing reveals whether a link ever existed.

• Two roles per agency: owners (billing, compliance, branding, team) and recruiters (roles, invitations, reports, decisions). The last owner can never be removed.
• Every action — settings changes, invitations, decisions, shares, deletions, holds — is written to an append-only audit log. The application can add entries but never change or delete them.
• Sign-in uses Supabase Auth (email and password, or Google) with secure session cookies and provider-side rate limiting.

• Candidate speech is treated as untrusted input. The interviewer has no tools it can call, and attempts to instruct it are treated as ordinary answers, never as instructions.
• The interviewer works from a hard deny list and never asks about protected characteristics.
• Language-model vendors are configured not to train on your content where they offer that setting.

Email support@interview100x.comwith “Security report” in the subject, what you found and how to reproduce it. We aim to acknowledge reports within two business days and won’t take action against good-faith research that avoids other people’s data. Subprocessors are listed on the compliance page.