Security, tenant isolation & AI governance

Tenant isolation

Organisation data is scoped server-side. Org admins can only access users, assessments, and candidate records within their organisation. Cross-tenant query parameters are blocked with org-scoped authorization checks.

Defense in depth

• Default-deny middleware on /api/* with an explicit public allowlist for registration, OTP, and careers browse
• Assessment and question routes require authentication and assessment-level access checks
• AI endpoints rate-limited with fail-closed behavior when client IP cannot be determined
• Scheduled jobs (reminders, payment verification) require CRON_SECRET

Human-in-the-loop hiring

AI generates questions and scores responses, but hiring decisions stay with your team. Integrity signals and authenticity scores are disclosed — never used to auto-reject without review. Verified skill badges require a passing assessment score, giving you a concrete signal beyond résumé keywords.

Data retention

Candidate responses, evaluation records, and audit logs are stored in your organisation's tenant. Production MongoDB is backed up weekly to encrypted off-site storage (AWS S3, ap-south-1) with an eight-week retention window. Contact us for data export or deletion requests per your compliance requirements.

Security testing

• Internal weekly vulnerability scanning — API auth review plus npm audit in CI
• Last structured OWASP Top 10 (2021) review: 31 July 2026 — 0 open critical or high findings
• Public scanners you can re-run: Mozilla Observatory and Qualys SSL Labs. These are automated checks, not a penetration test.
• Third-party penetration test: planned. Written report available to employers on request when completed.

Employer due diligence pack

Pilot and procurement reviews should cover security, candidate transparency, and data handling together.

• This page — tenant isolation, defense in depth, security testing, human-in-the-loop hiring
• Candidate integrity: How assessments work — matching-first, optional PRACTICE
• Privacy Policy — candidate and employer data flows
• Subprocessors — Atlas, OpenAI, Vercel, AWS S3, Resend (see Privacy Policy §4.5)
• Standard Data Processing Agreement (DPA) for EU/UK GDPR prospects — available on request; email support@feedbackai.live from your work domain before uploading candidate PII (T-172)
• Security overview one-pager — infrastructure, controls, and AI handling for employer due diligence