Security

What KASAUTI IQ does today to protect accounts, company data, recordings and files, and what it doesn't have yet.

Report a Vulnerability Read the Privacy Notice

Request ChecksSample data

GET/api/v1/candidates/…

1Same-origin requestOrigin matches the appPassed
2SessionValid, not idle, not revokedPassed
3CompanyCaller's own company onlyPassed
4Permissioncandidates.viewPassed
5InputValidated against a schemaPassed

Any failed check stops the request. Changes are written to the audit log.

Assurance status

What has been checked, and by whom.

The controls on this page are in the product's code today. None of them has been audited by an independent party yet.

Certifications: None. No third-party security certification or attestation has been obtained, and we don't claim one.
Penetration Testing: No independent penetration test report is available to share.
Two-Step Sign-In: Not offered. People sign in with an email address and a password.

Access control

Each company sees only its own data.

Authorisation happens on the server for every request. Hiding a button is never the only thing standing in the way.

Passwords: Stored only as Argon2id hashes, never as typed. New passwords need at least 12 characters with a letter and a number, can't be easy to guess and can't be the account's email address.
Sign-in protection: Sign-in is rate limited per network address and checked by Cloudflare Turnstile. After five wrong passwords an account is locked for 15 minutes. The error never says whether an account exists.
Sessions: An HTTP-only, Secure, SameSite cookie that page scripts can't read. The server keeps only a hash of it. A session ends on sign-out, after 24 hours without use, or after 7 days at most.
Company separation: Every request is checked on the server against the caller's session, company and permissions before any data is read. Browsers have no direct access to the database: Row Level Security is on for every table and all access goes through the server.
Roles and permissions: Company admins, recruiters and interviewers each have a set of permissions, which a company admin can adjust. Permissions can limit someone to the positions and candidates they are assigned to.
Platform support access: When KASAUTI IQ staff need to see an account to help, they use a support view that needs a stated reason, lasts at most 30 minutes, and records everything done in it in the audit log.

Files and recordings

Recordings and résumés stay private and expire on schedule.

The most sensitive things in a hiring process are files. They never get a public address.

Private storage: Résumés, interview recordings, proctoring photos and company logos are kept in private storage buckets. None of them has a public address.
Short-lived links: Files open through signed links that expire: 60 seconds for résumés and assessment photos, 10 minutes for interview photos, 30 minutes for recordings.
Checked uploads: Each bucket accepts only its file types and sizes. Résumés must be PDF or Word files of up to 10 MB; photos are JPEG images of up to 1 MB.
Retention: Each company sets how long interview data is kept: recordings 30–365 days (90 by default), photos 7–180 days (30), transcripts and reports 90–1095 days (365). A nightly job deletes what has expired.
Deletion on request: A company can delete a candidate's recordings, photos, transcripts, reports and notes from every interview at once. The deletion is recorded in the audit log.
Encryption: All traffic uses HTTPS. Data at rest and its backups are handled by the managed database and storage service (Supabase); we don't publish a separate backup schedule.

In the browser

Every page is sent with strict security headers.

Requests that change data must also come from this site; anything sent from another site is refused.

Header	What It Does
Strict-Transport-Security	Browsers use HTTPS only, for two years, including subdomains.
Content-Security-Policy	Scripts run only from this site with a fresh random value on every request. Plugins, forms that post to other sites and framing are blocked. Cloudflare's check is allowed on the sign-in page only.
Permissions-Policy	Camera, microphone and screen sharing are allowed only on interview and assessment pages. Location is never allowed.
X-Frame-Options	No other site can show these pages inside a frame.
X-Content-Type-Options	Browsers don't guess a file's type, so an upload can't run as a script.
Referrer-Policy	Other sites see only this site's address, never the full page path.

Logging and incidents

Changes leave a record that can't be edited.

Audit log: Every create, update, status change and permission change is written with who did it, when and from which address. The database refuses to change or delete these rows.
Server logs: Passwords, tokens, cookies and signed links are removed before a log line is written.
Errors: People see a plain message and a request reference, never a stack trace or database detail.
Incidents: We follow a written runbook: find the cause, contain it, revoke affected keys, check the audit log and tell the companies affected.

Services We Use

KASAUTI IQ is built on these services. Each one is used only for the part of the product listed.

SupabaseDatabase and file storage
LiveKitVideo calls, recording and live transcription
Anthropic (Claude)AI drafts, when a company uses the AI features
Judge0Running code from the interview code editor
ResendInvitation, reminder and notification emails
Cloudflare TurnstileThe security check on the sign-in page

Report a Vulnerability

If you think you've found a security problem, tell us through the contact form. Include the page or address, what you did and what you saw. Please don't access other people's data, and give us time to fix the problem before you share it.

Report a Problem

Bring your security questions to the demo.

We'll walk through how access, recordings and retention work with your own team's setup.

Book a Demo See Pricing

1
We reply within one working day to agree a time and the roles to cover.
2
A 30-minute walkthrough of the product with your own positions.
3
A pilot if it fits with a defined group of candidates.

Strict-Transport-Security

Browsers use HTTPS only, for two years, including subdomains.

Content-Security-Policy

Scripts run only from this site with a fresh random value on every request. Plugins, forms that post to other sites and framing are blocked. Cloudflare's check is allowed on the sign-in page only.

Permissions-Policy

Camera, microphone and screen sharing are allowed only on interview and assessment pages. Location is never allowed.

X-Frame-Options

No other site can show these pages inside a frame.

X-Content-Type-Options

Browsers don't guess a file's type, so an upload can't run as a script.

Referrer-Policy

Other sites see only this site's address, never the full page path.

Services We Use

KASAUTI IQ is built on these services. Each one is used only for the part of the product listed.

SupabaseDatabase and file storage

LiveKitVideo calls, recording and live transcription

Anthropic (Claude)AI drafts, when a company uses the AI features

Judge0Running code from the interview code editor

ResendInvitation, reminder and notification emails

Cloudflare TurnstileThe security check on the sign-in page