Security and trust, said plainly
This page says what protects your hiring data today, what is not in place yet, and who handles it. It claims only what is true, so your security team can judge Ituka on facts.
How your data is protected today
- Passwords are stored as one-way bcrypt hashes, never in a form that can be read back.
- Browser sessions use cookies that page scripts cannot read, sent only over HTTPS in production, and the site tells browsers to use HTTPS only.
- The database and the file storage are encrypted at rest and are not reachable from the internet. The database is backed up automatically, with seven days kept, and is protected against accidental deletion.
- The application runs on Amazon Web Services in the United States (us-east-1).
- Each organization sees only its own data, and roles decide what each person can see and do. For Interview as a Service the database itself enforces the separation between employers with row-level security.
- Sign-ins, failed sign-ins, password resets, role changes and organization actions are written to an append-only audit trail.
- Sign-in and public endpoints are rate-limited.
- A signed offer letter cannot be changed, and the database enforces it, not only the application.
What candidates are told, and can do
- Video recording of an interview is optional. Audio only is always offered, and neither choice is picked for the candidate.
- The notice says what is recorded, who can watch it, how long it is kept, and that no AI analyses it.
- Recordings are deleted after a set number of days (30 by default, never more than 90), and the candidate can delete theirs, even after the page is closed.
- Only people at the employer who review the interview can watch a recording, and each viewing is recorded.
- Links sent to a candidate open a page and do nothing else, and compensation is never put in the body of an email.
AI and your data
Ituka uses language model and voice providers to run interviews and read resumes. Our Privacy Policy lists the kinds of provider that process information for us, and requires them to protect it and not to use it to train their own models.
Nothing in an interview is acted on as an instruction to the assessor. A score never closes an application on its own. See Responsible AI.
What is not in place yet
- No SOC 2 or ISO 27001 audit has been completed, so we show no certification badge.
- Single sign-on with SAML or OpenID Connect, and SCIM user provisioning, are not available. People can sign in with a Google or Microsoft account or a password.
- Multi-factor authentication is not available.
- There is no public API and no outbound webhooks.
- Retention you can set yourself covers interview recordings. Other data is kept until the account or the record is deleted.
- Offer-letter signatures are a typed name with a recorded time, place and time zone, with no certificate on the document.
Questions and reports
Security questionnaires, procurement questions and vulnerability reports are welcome on the Contact page. We would rather answer a hard question than leave you to guess.
Questions about security
Is Ituka SOC 2 certified?
No. Ituka has not completed a SOC 2 or ISO 27001 audit, and it does not show badges it has not earned. This page lists what protects your data today and what is not in place yet.
Do you support single sign-on?
Not with SAML or OpenID Connect yet, and not with SCIM provisioning. People can sign in with a Google or Microsoft account or a password. Multi-factor authentication is not available yet.
Where is my data kept?
On Amazon Web Services in the United States (us-east-1), encrypted at rest. Interview recordings are kept in a private, encrypted store and deleted on a schedule.
Who can see my candidates' information?
People in your organization, according to their role. Our support staff can see an Interview as a Service employer's candidates only when the employer's owner allows it, for a time the owner chooses, and every look is recorded where the owner can see it.