Security & AI Governance

Principles you can point at.

Human-in-control AI, strict tenant isolation, and candidate rights, enforced in the database, not just the docs.

Principles

Eight commitments, one workspace.

These aren't marketing lines, each maps to a control you can inspect in the product.

Tenant isolation

Every organization's data is strictly isolated at the database level via Row-Level Security.

Private storage

Files live in private buckets, accessed only via short-lived signed URLs.

Human decisions

AI recommendations are never final. Humans control shortlists, offers and rejections.

Cited evidence

Every recommendation cites the evidence and confidence it is based on.

Candidate rights

Candidates can request correction or human review of any AI output.

Consent-controlled

Professional verification is consent-controlled and disclosed to candidates.

No protected inference

We never infer protected characteristics from CVs, interviews or facial analysis.

Append-only audit

Every candidate access, decision, override and export is written to an append-only audit log.

Architecture

Isolation, enforced in the database.

Every table carries an org_id. Row-Level Security lives in the database itself, not the API layer, so a bug in application code cannot cross-contaminate tenants.

Files never live on public URLs. Every download is a short-lived signed URL scoped to the requesting user, the org they belong to, and the file they're allowed to see.

org 1org 2org 3Row-Level Security
Tenants can never see each other's rows
Candidate rights

Rights, wired into the product.

Not a legal page, actual buttons candidates can press.

Step 01
Consent captured

Before any processing begins, candidates see and agree to what's collected and why.

Step 02
Processed with citations

Every AI output cites the source in the CV, transcript, or work sample.

Step 03
Review & correct

Candidates can request correction of any parsed field or AI-generated summary.

Step 04
Human review

One click escalates any decision to a named human reviewer with a full transcript.

Our commitments

What we guarantee, in numbers.

0%
Decisions logged to audit trail
0
Protected-characteristic inferences
0+
Tables with RLS enforced
0min
Max signed-URL lifetime
Human-in-control AI

Read it, then test it.

Book a security walkthrough with a human, we'll open the policies, the audit log, and the RLS rules with you.