Engineered for interviews. Not for surveillance.

Your interview's speech-to-text streams live through a commercial transcription provider under a zero-retention agreement. Audio flows through transcription live and is not written to our servers. We do not persist raw interview audio anywhere. Our current subprocessor list is available to customers on request at [email protected].

So that you can review how an interview went, we store an encrypted archive of the transcript and the AI's responses in Cloudflare R2 under your account, retained until you delete it or close your account. Raw audio is never part of it. Ask us and we will switch it off for your account.

Uploaded resume, JD, and knowledge-base files are parsed, chunked, embedded, and stored (encrypted at rest) in Postgres + pgvector on our VPS and mirrored to R2 for desktop sync. Indexing is required for retrieval — the AI can't ground answers in your resume without it.

You can delete any file from the KB page at any time. Deletion removes the file, all its chunks, and its embeddings immediately. No soft-delete window.

The HUD renders in a window layer that Zoom, Google Meet, and Microsoft Teams' screen-capture APIs skip. This is the same technique competitors use — we test it against a fresh install of each app on every release. If you find a screen-share leak, we pay a bug bounty (details below).

Sign-in uses email + one-time code (no passwords). Session cookies are HttpOnly, SameSite=lax, HS256-signed. Desktop access tokens are HS256 JWTs with a 1.5-hour hard session cap; refresh tokens rotate on every use with reuse detection (a stolen refresh token immediately kills the session).

Single-Tauri policy: signing in on a new desktop revokes the prior session. Single-browser policy: signing in on a new browser bumps a per-user counter that invalidates the old cookie on next request. CSRF-safe: all state-changing routes enforce same-origin; sign-in code and speech-to-text credential endpoints are rate-limited to close mail-bomb and budget-drain vectors.

The desktop app is code-signed on both platforms. The macOS build is signed with an Apple Developer ID and notarized by Apple, so Gatekeeper verifies it before first launch. The Windows installer is code-signed. Signing means your operating system can confirm who built the binary and that nobody altered it in transit — you are not asked to override a security warning to run it.

Email [email protected] with the subject line [bug bounty] for any of the following. We pay in USD via Wise or on-chain.

• Screen-share leak — HUD becomes visible to a call participant. $500.
• Remote code execution via the desktop app. $2,000.
• Bypass of the OS-keychain encryption on the local DB. $1,000.
• Any XSS / auth bypass on this website. $250.

Please give us 90 days before public disclosure. We ship fixes fast and credit you in the release notes if you want.