Security & data
Updated 17 October 2026
In short: your data sits with named providers, is encrypted in transit, is shown only to the people who need it, and recordings are deleted automatically. We are open about what we have not certified yet.
1Where your data lives
| What | Where |
|---|
| Accounts, assessments, answers and scores | A managed PostgreSQL database on Render. |
| Recordings, photos and uploaded files | Private storage on Cloudflare. Files are not public: they open only through short-lived private links. |
| Emails (invites, codes, reminders) | Sent through Resend. |
| AI marking of written and spoken answers | The text of an answer goes to Anthropic. The AI never watches video. |
Our providers run servers outside Pakistan, including in the United States. The Privacy Policy lists every provider and what each receives.
2Who can see what
- Candidates see only their own test and, where the recruiter allows it, their own report.
- Recruiters see the people they invited. Inside a company account, the head of HR decides which team members can create assessments, use video and see results.
- Hiring managers see only what a recruiter shares through a shortlist link: names, rank and, if the recruiter allows, scores. They never see email addresses, answers, photos or recordings, and the link expires and can be switched off at any time.
- HireVation staff access customer data only to run and support the service.
3Links and sign-in
- Every candidate invite has its own private link. A link works for the person it was made for; anyone who is forwarded a link can open it, so tell candidates not to share it.
- Open assessment links ask the candidate to confirm their email with a one-time code.
- Recruiters and candidates with accounts sign in with a password (stored only as a one-way hash) or with Google or Microsoft sign-in, and can use one-time codes.
- Sign-in codes, invite starts and report look-ups are rate limited to slow down guessing.
- Share links (performance sheets, shortlist links) can be switched off, and shortlist links expire on their own.
4How it is protected
- All traffic is encrypted in transit (HTTPS).
- Passwords are hashed. We cannot read them.
- Answer keys and scoring data stay on the server and are never sent to the candidate's browser.
- Recordings and photos are served through private, time-limited links, not public addresses.
- Access to the database and storage is limited to the people and services that need it.
- Secret keys are kept in the hosting environment, not in the code.
5How long we keep it
Interview and session recordings are deleted automatically 60 days after the assessment. Candidate reports stay available for 90 days. Accounts are kept while they are open. Full details are in the Privacy Policy.
6Your control
Candidates and customers can ask to see, correct or delete their data by emailing support@hirevation.com from the address on the account. Recruiters can delete assessments, candidates and shared links in the app.
7What we do not claim
We are honest about where we are. HireVation does not yet hold an independent security certification such as SOC 2 or ISO 27001, and no online service is perfectly secure. If you need a security questionnaire answered for your company, email us and we will answer it plainly.
8Report a problem
If you find a security problem, please email support@hirevation.com with what you saw. Please do not access other people's data while testing. If a breach is likely to harm you, we will tell the affected people without undue delay.
