TRUST AND DATA
Trust, data handling, and responsible AI hiring
This describes how the product actually works today, not a formal legal document. It is not a substitute for your own counsel’s review. For the current privacy explainer and Terms of Service, see /privacy and /terms.
What data is collected, and where it goes
Your account, your interview conversation, your generated report, and any document you upload (like a resume) are collected to run the assessment and produce your report. Uploaded documents are stored in a private storage bucket scoped to your account, never public, and text is extracted from them only to add context to your interview — the file itself is never rendered, served, or interpreted as anything but text to read.
Seven systems your data passes through to make that happen:
Supabase
Your account, your assessment conversation, your report, and any uploaded documents are stored in Supabase Postgres and Storage.
Anthropic
Your conversation is sent to Anthropic’s Claude API to run the interview and generate your report.
Resend
Sends your account emails (confirmation, password reset, report-ready) and, if you join a waitlist, that follow-up.
Cloudflare
Verifies you’re human at registration (Turnstile) and sits in front of the domain for DNS and delivery.
Railway
Hosts the application itself, both the part you see and the backend that talks to the services above.
PostHog
Receives product analytics events (pages viewed, buttons clicked) and session recordings of public pages. Recording is switched off on the home page and on the assessment interview, check-in, report, shared result, plan, onboarding, account, sign-in, registration and team pages. Typed form fields are masked, and console messages and network request contents are not recorded. Emails, tokens and answer text are filtered out of events before they are sent. Recordings are kept for 30 days.
Sentry
Receives error reports when something breaks in your browser or on our servers. Request bodies and local variables are not attached, and emails, tokens and answer text are filtered out before sending.
How long data is kept
There is no automatic deletion policy yet. Your conversation, report, and any uploaded documents are retained for as long as your account exists. We would rather say that plainly than imply a retention window that doesn’t exist.
Who can see a given report
- You
- Your own conversation, report, and development plan. Always.
- An evaluator, manager, or HR at your organization
- Only if your organization sponsored your assessment, or you accepted a manager's team invitation. You're told which applies before the interview begins.
- A manager on a self-serve team
- The reports of people who accept their invitation, and nobody else's. A trigger in the database enforces this: a self-serve team can never add an HR role, so the inviting manager is the only reader.
- HR at a provisioned organization
- Every member of that organization’s reports, the arrangement an organization explicitly signs up for, not a default.
How the rubric itself is built
The same competency framework and evidence standard. Every participant is assessed against the same 16 competency dimensions, with findings linked to evidence collected in that assessment and a stated confidence level on each score. Adaptive interviews may follow different question paths, and consistency of scoring has not yet been formally demonstrated. Formal validation and adverse-impact analysis have not been done. Results inform development conversations and do not make employment decisions.
It informs the decision, it does not make it. Every report is built to support a human hiring, promotion, or development conversation, never to replace it. A person always makes the call.
Scored on what you did, not who you are. The rubric evaluates the decisions you describe, the tradeoffs you weighed, and the results that followed. It does not ask you to disclose protected characteristics, and the same rubric applies to everyone.
Where things honestly stand on regulation
If you’re bringing this into a hiring, promotion, or succession process, your legal team is likely thinking about frameworks like:
- New York City Local Law 144, which requires an annual bias audit for automated employment decision tools used in NYC-based hiring
- The EU AI Act, which classifies certain employment-related AI systems as high-risk and attaches obligations to them
- The Uniform Guidelines on Employee Selection Procedures and the four-fifths rule long used in U.S. employment law
Formal validation and an adverse-impact or bias audit have not been done, and we do not claim otherwise. We are not making a compliance claim under any of the frameworks above until that work is done. We would rather tell you where we actually are than overstate it.