Sécurité
Sécurité & protection des données
Comment nous protégeons vos données, depuis le début d'une session de pratique jusqu'au-delà de votre embauche.
Contrôles de sécurité
Transport encryption
All traffic served over HTTPS with HSTS enforced (max-age 63072000, includeSubDomains, preload). TLS 1.2+ enforced at the CDN layer.
Data at rest
All database data encrypted at rest by Neon (AES-256). Clerk session tokens stored encrypted. No sensitive data stored in plain text.
Authentication
Managed by Clerk, with industry-standard OAuth2/OIDC flows, brute-force protection, and session expiry. We never handle raw passwords.
Camera data
Camera video is processed entirely in your browser using MediaPipe. No video frames are sent to our servers. No video is stored.
Voice/audio
Live transcription uses your browser's built-in speech recognition. For filler-word and delivery analysis a short audio clip is sent to OpenAI's Whisper API, transcribed, and then discarded; it is not stored on our servers. Voice mode is optional.
Access controls *
Protected API routes require authenticated Clerk session tokens. Unauthenticated requests to protected endpoints return 401. Rate limiting applied to all AI endpoints.
Security headers
HSTS, X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy (camera/microphone self-only), X-XSS-Protection enforced on all responses.
Dependency management
Dependencies reviewed regularly. Production build runs against locked package versions. Critical CVEs addressed as a priority.
* Two endpoints are intentionally public by design: /tools/star-scorer (free STAR answer scorer, IP-rate-limited to 5 requests per hour) and /api/assessment/[token] (assessment invites issued by hiring teams using single-use cryptographic tokens). Neither endpoint exposes personal candidate data.
Sous-traitants
We use the following third-party services to operate the platform. Each is bound by a Data Processing Agreement where required under UK GDPR.
| Prestataire | Finalité | Localisation |
|---|---|---|
| Clerk | Authentication and session management | US (EU data stored in EU region) |
| OpenAI | AI analysis of interview answers and transcripts | US |
| Neon | PostgreSQL database (candidate profiles, sessions) | UK (AWS eu-west-2, London) |
| Vercel | Hosting and edge delivery | Global CDN, origin EU/US |
| Resend | Transactional email (assessment invites) | US |
Vos droits en vertu du RGPD britannique
Vous avez le droit d'accéder, de corriger, d'exporter et de supprimer vos données à tout moment. La plupart de ces actions sont disponibles directement depuis votre page de profil. Pour les demandes que nous ne pouvons pas traiter automatiquement, contactez-nous à privacy@aicareermentor.co.uk et nous répondrons dans les 30 jours.
Divulgation responsable
If you discover a security vulnerability, please report it to security@aicareermentor.co.uk with a clear description and reproduction steps. We will acknowledge receipt within 48 hours and work to resolve critical issues as a priority. We ask that you do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.
Besoin d'un DPA ou d'une revue de sécurité ?
Les clients entreprise peuvent demander un Accord de Traitement des Données, nos réponses au questionnaire de sécurité ou un appel de conformité avec notre équipe.
Contacter l'équipe entreprise →