Everything on this page is read from the running product and its configuration, so it only lists what is true today. For a copy to share inside your company, download the security overview (PDF).
Hosting and data location
The application, database and file storage are hosted in the United States by Railway Corporation. Every company that processes personal data for us is on the sub-processors page.
Encryption
- In transit: All traffic to the app and the API uses HTTPS (TLS). The API sends HSTS and a strict content security policy.
- At rest: these fields are encrypted in the database with AES-256-GCM envelope (per-value data key wrapped by a key-encryption key): Interview answer transcripts, Consent record IP address, Consent record browser details, Accommodation requests, Phone numbers on candidate profiles, resumes and text message settings, Resume files.
Access and account controls
- Tenant isolation: Every API request is checked against the user's company and role, so one company cannot see another company's candidates.
- Password storage: Passwords are stored as bcrypt hashes. Sign-in tokens are short-lived and refresh tokens live in HTTP-only cookies.
- Staff multi-factor authentication: Infyva admin accounts must sign in with two-factor authentication. Support sessions that view a customer account are read-only, enforced on the server.
- Two-factor authentication for your team: Any user can turn on two-factor authentication with an authenticator app.
- Required two-factor authentication: Workspace owners can require two-factor authentication for every member. Enterprise plan.
- IP allowlist: Limit sign-in to your workspace to the IP ranges you list. Enterprise plan.
- Session timeout: Set how long a signed-in session may stay idle before it ends. Enterprise plan.
- Password policy: Set minimum password rules for your workspace. Enterprise plan.
- Access review export: Export who has access to your workspace and their roles, for periodic reviews. Enterprise plan.
- Platform audit log: Every Infyva admin action is logged with who, what, why, when and from which IP address.
- Workspace audit log: Owners and admins can see the actions taken in your workspace and export them. Enterprise plan.
- Private recordings: Recordings are kept in private storage, played only through short-lived signed links and deleted after 90 days.
- Abuse limits: Sign-in, password reset and privacy requests are rate limited.
- Log filtering: Application logs and error reports are filtered to strip email addresses, sign-in links, one-time codes and API secrets.
What we do not claim
- We do not have a SOC 2 report or an ISO 27001 or ISO 42001 certificate.
- We do not publish penetration test results or promise an annual test.
- We have not had an independent bias audit.
How we test our AI scoring for bias is described on AI and fairness.
Privacy and data protection
- Data Processing Agreement (version 2026-10-19b), part of our Terms.
- Recordings are deleted after 90 days. The full schedule is in the privacy policy.
- Anyone can make a privacy request. We answer within 30 days.
- If a security incident affects personal data, customers under the DPA hear from us within 72 hours. Service status is on our status page.
Security questionnaire
Request our completed security questionnaire from security@infyva.ai.
Report a vulnerability
Email security@infyva.ai with the details and how to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and do not access other people's data while testing. Our contact details are also in security.txt.