Security & Trust
Last updated: May 24, 2026
The short version: Your data is encrypted in transit and at rest, stored on SOC 2 Type II certified infrastructure, protected by row-level access controls, and never used to train AI models. We list every third party that touches your data below.
Overview
InterviewKits helps hiring teams generate interview kits and candidate verdicts. The data you put in (job descriptions, candidate notes, interview transcripts) is sensitive, and we treat it that way. This page explains exactly how it is stored, who can access it, and which third parties are involved.
Infrastructure & certifications
InterviewKits is built on Supabase , which runs on AWS infrastructure. This means we inherit the following certifications and controls:
- SOC 2 Type II - Supabase undergoes annual SOC 2 audits covering security, availability, and confidentiality.
- GDPR compliance - Data processing agreements available, EU data residency options.
- HIPAA - Available on Supabase enterprise plans (not currently enabled for InterviewKits).
- ISO 27001, PCI DSS - Inherited from the underlying AWS infrastructure.
- Regular third-party penetration testing of the Supabase platform.
Encryption
- In transit: All traffic uses TLS 1.2 or higher. HTTPS is enforced on every endpoint.
- At rest: The database and file storage are encrypted at rest using AES-256.
- Secrets: API keys, OAuth tokens, and Stripe credentials are stored in an isolated secrets vault, never in the database or source code.
Access controls
- Row-Level Security (RLS): Every table that holds your data has database-level policies enforcing that you can only read and write rows tied to your user ID or organization.
- File storage: Generated Word documents and PDFs are stored in private buckets and only accessible via short-lived signed URLs (5-minute expiry).
- Authentication: Email + password with bcrypt hashing, with optional password reset via signed magic links.
- Admin access: Internal admin tools require a separately granted admin role and are scoped to operational use only.
Data handling
- Ownership: You own your data. We are a processor, you are the controller.
- Retention: Data is retained while your account is active. On deletion request, we remove your data within 30 days.
- Backups: Daily encrypted backups with point-in-time recovery up to 7 days.
- Export: You can export every kit and verdict as Word or PDF directly from the app.
AI providers
Interview kits and verdicts are generated using large language models from OpenAI and Anthropic, accessed via API. Both providers contractually agree:
- Your data is not used to train their models.
- API inputs and outputs are retained for a maximum of 30 days for abuse monitoring, then deleted.
- SOC 2 Type II certified, with GDPR data processing terms.
Sub-processors
These are the third parties that may process your data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, file storage, authentication | USA |
| AWS | Underlying cloud infrastructure | USA |
| OpenAI | Interview kit and verdict generation | USA |
| Anthropic | Interview kit and verdict generation | USA |
| Stripe | Payment processing | USA |
| Resend | Transactional email | USA |
Enterprise SSO
SAML-based single sign-on (Microsoft Entra ID, Google Workspace, Okta, OneLogin) is available on the Enterprise plan. This lets your IT team:
- Centrally provision and de-provision users.
- Enforce your existing MFA and conditional access policies.
- Automatically revoke access when an employee leaves.
Currently in setup. Contact us if you need SSO before going live.
Incident response
In the event of a security incident affecting your data, we will notify you within 72 hours of confirmation, in line with GDPR requirements. We log all administrative actions and infrastructure events for forensic review.
Contact
Security questions, vulnerability reports, or requests for documentation (DPA, sub-processor updates, security questionnaires): email ask@interviewkits.ai.