Security

• Each organisation's data is separate. Every read and write of company data carries the organisation's id, and an automated check fails the build if a route reads without it.
• Recordings are encrypted on the candidate's device before they are sent, with a key per recording that is wrapped by a key per organisation. Storage holds ciphertext only.
• Recordings are opened through links that last 10 minutes, only for people at the company with a reviewing role, and there is no download button.
• Every time a recording or report is opened is logged in the organisation's audit log, by role and id, never by candidate name.
• Our staff have no screen or route that plays a recording. Staff can rotate an organisation's key or end the organisation's use, which deletes its recordings.
• Recordings are deleted on the schedule the company chose, or at once on a candidate's request, and a record of each deletion (times and sizes only) is kept as proof.
• Invitation links are looked up by a one-way hash. An encrypted copy is also kept so a reminder can send the same link again. A link on its own opens only the landing page: starting the interview needs a sign-in as the invited address.
• Invitation, sign-in and upload routes are rate limited.
• Database backups are encrypted and kept in a separate bucket with its own key.

• Our server holds the master key that unwraps organisation keys, so we are technically able to read a recording; no route, screen or staff role does, and every key release is logged. Keys held by the organisation are not offered yet.
• An independent penetration test has not been done yet. It is planned before the first paying company; the scope is written and available to customers on request.
• An outside bias audit of the scoring has not been done yet. A fairness view inside the product shows totals for groups of five or more people.

Write to pressentify@gmail.com. We acknowledge reports within two working days.