This page describes how the Anytime Interview platform protects customer and candidate data. Sections below cover data protection, access and authentication, data residency, subprocessors, compliance posture, and vulnerability handling.
Last reviewed:
Data protection
- HTTP Strict Transport Security is enforced with a two-year max-age, subdomain coverage, and preload.
- A Content Security Policy is enforced on every non-API response with a per-request nonce and strict-dynamic on script-src.
- A CI check runs the CSP-enforcement Playwright suite against staging on every pull request.
- The response set includes X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and a Permissions-Policy that denies camera, microphone, geolocation, and payment by default.
- Camera and microphone permissions are only granted on the candidate interview route.
- Interview recordings are stored in access-controlled Cloudflare R2 and served only via short-lived presigned URLs.
- Email verification, password reset, interview access, and share-report tokens are stored as SHA-256 hashes at rest.
Access and authentication
- Operator sign-in accepts email and password, Google, or Microsoft Entra ID.
- Passwords are stored as bcrypt hashes.
- TOTP-based two-factor authentication is available, and organisation owners can require it for their members.
- Repeated failed sign-in attempts trigger account lockout and email notification to the account holder.
- Sign-in, registration, and password-reset endpoints are protected by Cloudflare Turnstile server-side verification, failing closed when the secret is unset.
- Sessions are absolute-capped at eight hours and idle-capped at thirty minutes.
- Every authenticated request checks the session against a database revocation flag, so a user's "sign out everywhere" propagates within a minute.
- Users can list and revoke their own active sessions.
- Email verification uses HMAC-signed tokens whose SHA-256 hashes are stored server-side; raw tokens are never persisted.
- Multi-tenant access is enforced through a per-organisation Membership boundary; every organisation-scoped API route runs through a role-checked wrapper.
Data residency
- The application is hosted on Vercel's Sydney region (syd1).
- Interview recordings are stored in Cloudflare R2 via an account-scoped S3-compatible endpoint.
- A production-only environment guard fails closed unless ALLOW_PRODUCTION_DB is explicitly set on the production deploy environment, preventing accidental cross-environment DB connections.
Subprocessors
- The subprocessor register below lists every third party that processes customer or candidate data on our behalf.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Anthropic | Large language model for interview question generation and assessment scoring. |
| United States |
| Deepgram | Speech-to-text transcription of candidate interview audio. |
| United States |
| ElevenLabs | Text-to-speech for the AI interviewer voice. Only our question text is sent; no candidate personal data. |
| United States |
| Cloudflare R2 | Object storage for interview video and audio recordings. |
| — |
| Neon | Managed serverless Postgres for application data (accounts, jobs, interviews, transcripts, scores). |
| — |
| Vercel | Application hosting and delivery. |
| Sydney (syd1), with global edge |
| Stripe | Payment processing for customer subscriptions and credit packs. |
| United States / global |
| Resend | Transactional email delivery (interview invitations, receipts, account notifications). |
| United States |
| Cloudflare (Turnstile) | Bot protection on registration, sign-in, and password-reset endpoints. |
| Global edge |
Compliance
- We do not currently hold SOC 2, ISO 27001, ISO 42001, or AIUC-1 certification.
- The Australian Privacy Principles and, where applicable, GDPR and UK GDPR govern how we handle personal information; the Privacy Policy sets out the legal bases.
Vulnerability handling
- A machine-readable /.well-known/security.txt exposes our security-report contact and refresh date per RFC 9116.
- Every pull request runs an npm audit gate against production dependencies at High or Critical severity; a merge is blocked if a new advisory lands.
- A daily scheduled sweep re-runs the same audit against the promotion source branch to catch newly published advisories between deploys.
- Dependabot updates dependencies on a scheduled cadence, and an auto-merge lane lands security patches after CI passes.
- Browser CSP violations are collected on a same-origin reporting endpoint so unexpected policy trips surface in operations logs.
Report a security issue to privacy@anytimeinterview.com.au. Machine-readable contact details are also published at /.well-known/security.txt.
See the Privacy Policy and Terms of Service for the legal basis for processing and the terms governing use of the platform.
Machine-readable security contact: /.well-known/security.txt. Report intake address and process are in the Vulnerability handling section above.