Trust & Security
HiringTest.ai is built by Sidekick Software Inc. We've designed the platform to meet the security expectations of enterprise hiring teams. This page is a sharable summary — send it to your security or IT review.
SOC 2 Type II: audit in progress with a planned attestation report available for paying enterprise customers under NDA. Request the current bridge letter at security@hiringtest.ai.
GDPR / CCPA: we honour data-subject access, correction, and deletion requests within 30 days. Data-processing addendum (DPA) available on request and signed by default for enterprise contracts.
EEOC, Title VII, ADA: our assessment design follows the EEOC's Uniform Guidelines on Employee Selection Procedures. Scoring rubrics are validated against the job's competency requirements and audited regularly for adverse impact. Accessibility accommodations are available — see applicant accommodations.
In transit: TLS 1.2+ everywhere; HSTS enabled on all customer domains. Internal service-to-service traffic stays inside Azure Virtual Networks where possible.
At rest: AES-256 for the PostgreSQL database, Azure Blob Storage (audio + video + uploaded resumes), and internal logs. All ATS credentials are stored with an additional application-level AES-256-GCM wrap using a customer- managed master key in Azure Key Vault.
Secret management: production secrets live in Azure Key Vault with audit logging on every read. Rotation runs through a versioned registry; rollback is single-command. No secrets ever land in source control or in logs.
Customer authentication: LinkedIn or Google OAuth only. No password authentication means no credentials to leak. Recruiter accounts on a company are role-gated (admin / member / viewer / IT support) with the principle of least privilege — role permissions are documented in detail.
Internal access: Engineering access to production data requires Entra ID authentication with hardware-key MFA. Every production- data query is logged. Customer-data access by Sidekick employees is restricted to named support incidents with opt-in customer consent — see the impersonation audit trail referenced in the DPA.
Bring-your-own-SSO: on the enterprise plan, we support SAML SSO via your identity provider (Okta, Entra ID, Google Workspace). SCIM user provisioning is on the 2026 roadmap.
What we store: recruiter and candidate profile data (name, email, LinkedIn handle), assessment responses (text, audio, video, sandbox transcripts), scoring metadata, and integrity signals (time-per-question, tab-switch events, paste events). We do not scrape LinkedIn beyond the basic OAuth profile scopes, and we do not buy or sell personal data.
LLM data handling: calls to underlying language models go through Azure AI Foundry under enterprise terms — your data is not used to train Microsoft, Anthropic, or OpenAI foundation models. Zero-day-retention is enforced on Anthropic Claude calls; other providers have 30-day abuse-detection retention with no human review unless legally required.
Retention: candidate assessment data is retained for the lifetime of the customer's active subscription, then deleted within 90 days of subscription termination unless the customer requests earlier purge. Aggregated, fully- anonymized benchmark statistics may persist longer for model calibration; these contain no personally identifiable information.
Backups: Azure-managed continuous backups with 30-day point-in- time recovery. Cross-region replication for disaster recovery.
Transcript-based scoring (primary). Every assessment response — text answers, audio answers (transcribed), and video answers (transcribed) — is graded against the role's rubric by a large language model. This is the dominant signal in the composite score. The same prompt, schema, and rubric apply regardless of how the candidate chose to respond.
Delivery scoring (audio-derived, small weight). For roles where communication delivery is part of the job signal (most customer-facing and stakeholder-communication roles), the audio analyzer produces clarity and confidence scores on a 1-10 scale from the transcript. These feed a small “Delivery” subscore (default 7% of the composite). Modules where work product dominates (engineering, data science, accounting, etc.) opt out by default.
Presence scoring (vision-derived, advisory only today). Where the candidate recorded a video introduction, we sample keyframes and grade four observable dimensions: presence (engagement + attention), framing (recording competence), eye contact (camera-direction attention), and professionalism (environment + dress relative to the role's industry). The rubric anchors are explicit that scoring must be grounded in observable behavior, not inferred attributes. The model is prohibited from describing or scoring based on race, ethnicity, gender, age, religious dress or coverings, accessibility accommodations, hairstyle, or accent. Stillness is not scored as low presence; at-home recording is not scored as low professionalism; non-Western professional dress is not penalized.
Bias mitigation gate. Before vision scoring contributes weight to the composite, it must pass a calibration evaluation against a curated fixture set spanning intersectional demographic axes — same scripted answer, varied candidate appearance. If the evaluation surfaces measurable disparity (median score deviation > 1.0 points on the 1-10 scale, with tighter 0.7-point thresholds on the two bias-prone dimensions), the dimension stays in advisory mode: visible to the recruiter as judgment signal, zero contribution to the composite score. Today, vision scoring ships in advisory-only mode — recruiters see a Presence panel on the scorecard, but it does not move the score.
What the AI never does. None of our LLM calls produce demographic guesses, face descriptions, accent guesses, age estimations, or disability inferences. Output schemas at the structural level prohibit these in the rationale fields, and the calibration evaluation scans output text for demographic-descriptor terms before scores are released.
We use the following subprocessors. The current list is also maintained as an appendix to our DPA, and material changes are notified at least 30 days in advance to enterprise customers.
We follow an industry-standard incident-response plan with detection via Azure Monitor + Langfuse + Vercel logs. We commit to notifying affected customers within 72 hours of a confirmed security incident impacting their data, in line with GDPR Article 33.
Report a suspected security issue to security@hiringtest.ai. We don't currently run a public bug-bounty program but coordinate responsible disclosure with researchers on request.
Uptime target: 99.9% on enterprise plans, monitored via Vercel + Azure health endpoints. Status page is available at status.hiringtest.ai.
Data portability: full CSV export of candidate data + scorecards is available to admins at any time. On request we provide an additional structured-JSON dump.
The following are available under NDA on request to security@hiringtest.ai:
This page is updated periodically as our posture evolves. For the most current information, contact security@hiringtest.ai.