The controls we actually run today. We would rather list fewer things that are true than more that are not.
Hosting
The application, database, cache and file storage run on Railway in United States. Email goes through Amazon SES and payments through Stripe. Every company that handles personal data for us is on the sub-processors page.
Controls in place
- Encryption in transit: all traffic uses HTTPS (TLS), with HSTS and a strict content security policy on the API.
- Accounts: passwords are stored as bcrypt hashes; sign-in tokens are short-lived and refresh tokens live in HTTP-only cookies.
- Tenant isolation: every API request is checked against the user's company and role, so one company cannot see another's candidates.
- Staff access: Infyva admin accounts require multi-factor authentication in production. Support sessions that view a customer account are read-only, enforced on the server.
- Audit log: every platform admin action is logged with who, what, why, when and from which IP address.
- Recordings: kept in a private bucket and only played through short-lived signed links; deleted after 90 days.
- Abuse limits: sign-in, password reset and privacy requests are rate limited.
- Logs: application and request logs are filtered to strip email addresses, sign-in tokens in links, one-time codes and API secrets. Error reports sent to Sentry are filtered the same way, and performance tracing in the browser only runs after analytics consent.
- Retention and erasure: a daily job deletes data on the published schedule, and erasure requests remove a person's data everywhere it is stored, with a record of what was removed.
- Sensitive data: the optional face presence check runs in the candidate's browser and creates no face template; demographic answers are stored apart and never used in scoring.
What we do not claim
- We do not have a SOC 2 report or ISO 27001 certificate yet.
- We do not publish penetration test results or promise an annual test.
- We have not had an independent bias audit yet. Our current bias tooling is described on AI and fairness.
Customers can request our completed security questionnaire once a year under the Data Processing Agreement.
Report a vulnerability
Email security@infyva.ai with the details and how to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and do not access other people's data while testing. We reply within a few business days.
Incidents
If a security incident affects personal data we tell affected customers without undue delay, and within 72 hours for customers under the DPA. Service status is on our status page.