An isolated database per workspace
Every customer workspace runs against its own database: physical separation, not a shared table with a tenant filter. Every query is scoped twice anyway.
Your data is yours
We never use your candidate data to train shared models. Teams that want full control can run TAP against a self-hosted model endpoint.
Regional hosting
Hosted in the EU/EEA with data residency that meets Nordic and European expectations. Encrypted in transit and at rest.
Access you can inspect
Role-based access with five roles, and a workspace audit trail covering exports, unmasks, stage moves and more, exportable as CSV.
The controls, in detail.
Access and control
Who sees what is decided on the server, never in the browser.
- SSO with Azure Entra ID and Google Workspace; password sign-in adds email one-time codes.
- Five roles (owner, admin, manager, member, viewer) with a strict hierarchy: nobody can grant authority above their own.
- Every permission in the catalogue is enforced by a route; permissions nobody enforces get deleted, not documented.
Isolation by design
Workspaces are physically separated, not filtered.
- Each customer workspace runs against its own database: its own project, keys, and storage.
- Every query is still scoped by workspace id on top of that. Two fences, one of which would already be enough.
- Cross-workspace reads have nowhere to go: the credentials for another workspace never enter the request.
Encryption and secrets
Encrypted in transit and at rest, with integration credentials treated as radioactive.
- TLS everywhere; data encrypted at rest by the database layer.
- Integration credentials (e.g. Flowcase tokens) are stored AES-256-GCM-encrypted, never in plaintext.
- Logs redact tokens and personal identifiers; the client strips them before anything is written.
AI guardrails
The AI helps decide. It is not allowed to decide.
- No automated rejection: the assistant refuses to make an adverse decision about a candidate.
- Requests touching protected characteristics are refused before scoring; invalid or unavailable scoring responses fail closed instead of becoming a score.
- Assistant web search is off by default, and queries are stripped of personal data before they leave the platform.
Blind screening, governed
Masking is policy, not a UI toggle someone can shrug off.
- Mask identity signals workspace-wide, per project, or per candidate. Fail-closed if settings cannot be read.
- Unmasking can require a second, distinct approver, and reveals expire on a timer and re-mask automatically.
- Every mask change, request, approval and reveal lands in the audit trail.
An audit trail you own
The customer is the data controller, so the record belongs to you.
- More than twenty event types: exports, unmasks, stage moves, role changes, evaluation runs, and more.
- Append-only, filterable in the app, exportable as CSV.
- Metadata is ids and enums. The trail itself never leaks personal data.
Data residency
Hosted in the EU/EEA, built for Nordic expectations.
- EU-hosted database and storage for every workspace.
- GDPR tooling in the product: consent records, per-candidate data export, and Article 17 erasure.
- No candidate data is ever used to train shared models.
Your model, if you want
The AI provider is a setting, not a dependency.
- OpenAI by default, behind a strict per-request data boundary.
- Or point the workspace at a self-hosted endpoint (Ollama, vLLM), with a test-before-save probe.
- Saved evaluations can be exported with the score, timestamp, and model and methodology version to support transparency reviews.
Aligned, and honest about the rest.
Building toward SOC 2 and aligned with GDPR. We'll publish each milestone here as it lands. No claims we can't back.
Security questions we actually get
Where is my data stored?
In an EU-hosted database dedicated to your workspace. Not a shared database with a filter: your own project, with its own credentials.
Is candidate data used to train AI models?
No. Data leaves the workspace boundary only for the specific request being served, and never for training. Workspaces that want zero third-party AI can run against a self-hosted model endpoint.
How is one customer isolated from another?
Physically: each workspace has its own database project. Logically on top: every query is scoped by workspace id anyway. A request for workspace A carries no credentials that could read workspace B.
Who at a customer can see candidate identities?
Role-based access controls who sees what, and blind screening can mask identity signals workspace-wide with dual-control unmasking. Every reveal is logged with who, when, and for how long.
Can we get our data out?
Yes: roster, audit-trail and evaluation exports as CSV, plus a per-candidate GDPR export as JSON. No lock-in is a design goal, not a slogan.
Are you SOC 2 certified?
Not yet, and we will not imply otherwise. We are building toward SOC 2 and publish each milestone when it lands. GDPR alignment, the audit trail, and AI decision records exist today.
How do I report a vulnerability?
Email contact@talentautopilot.com with "security" in the subject. A founder reads it the same business day, and we will keep you informed through the fix.
Running a security review?
We answer procurement and security questionnaires directly, founder to reviewer, usually within one business day.