Security and privacy
You are handing us other people’s personal information
CVs, phone numbers, recorded conversations. Candidates gave that to you, not to a software vendor. Here is what happens to it.
Separation
Your agency’s data is separated from everyone else’s
One agency cannot see another
Every record carries the agency it belongs to, and the database itself enforces the boundary rather than trusting the application to remember. A connection that has not identified its agency returns nothing at all, so forgetting to scope a query returns an empty result rather than somebody else's candidates.
There is no signup page
Agency accounts are created by us, not by anybody who finds the site. Within an agency there are two roles, owner and recruiter, and the owner manages their own people.
Sessions are short lived
Access tokens last fifteen minutes and refresh tokens rotate on use, so a stolen one stops working. Passwords are hashed with argon2, tokens are held in cookies JavaScript cannot read, and sign in is rate limited by address and by email.
Candidate data
What happens to a candidate’s information
CVs are deleted with the candidate
A CV is personal information under the Privacy Act. Deleting a candidate deletes the stored file too, rather than leaving an orphaned document behind and calling it a delete.
Recordings are not left on a public link
An interview recording lives in our own storage and is reached through a link signed for the person asking, which expires in minutes. Nothing is stored as a URL that would still work if it leaked.
Backups are verified by restoring them
Every night the database is dumped, restored into a scratch database beside the live one, and its row counts compared before the backup is kept. A backup nobody has restored is a hope, and every way it can fail is quiet.
Consent
Recording consent, said three times
Several Australian states require every party to a private conversation to consent to it being recorded. One notice buried in a footer does not carry that.
- 01The invitation email says the conversation is recorded and written down.
- 02The join page says it again, above the button, not below it.
- 03The interviewer says it aloud in its opening, so the notice is on the recording itself.
Pressing start is the consent. If we ever stopped keeping the audio, all three would have to change back.
Suppliers
Who else touches the data
Running screening calls means using specialist services. These are the ones that see candidate information, and what each is for.
- Retell AI
- Places the outbound screening calls and returns the transcript.
- Runs the in browser interview when a candidate uses an emailed link.
- Anthropic
- Reads CVs into structured records and scores completed calls.
- Cloudflare R2
- Stores uploaded CVs and interview recordings.
- Resend
- Delivers the screening invitation emails.
The detail, including how long we keep things and how to ask for a copy or a deletion, is in the Privacy Policy.