Security

What Hire Pad does to protect interviews and the people in them, in plain terms. Nothing on this page is a promise about things we haven't built.

Who can join a room

Candidates join with a link and never need an account. The link is the credential, so treat it like a password and share it only with the candidate.
Joining gives a signed token that works for 60 minutes and is renewed while the room is in use. Finishing or deleting an interview ends access at once.
The role (interviewer or candidate) is decided on our server from the signed-in session. Nothing a browser sends can make it an interviewer.
Interviewers sign in with an email and password.

A candidate can edit the code and the whiteboard. Changes to the question, the tests and the session state are refused by the collaboration server, and the connection is closed.
Hidden test cases and solutions are never sent to a candidate's browser. A candidate sees pass or fail for a hidden case, not its input or expected output.
A take-home's time limit is enforced by our servers, not just by the countdown on the page, and the work submits itself at zero.
A take-home keeps the question it was sent with, so editing your library later doesn't change what the candidate sees.

Code runs in an isolated sandbox with no network access and limits on CPU time, wall-clock time and memory.
Output is capped at 64 KB per run.
Runs are rate-limited: at most 10 runs per 30 seconds in one room, and 4 at a time across the service.

Only the interviewer who created an interview can read its recording, runs, notes and participants. This is enforced in the database (row level security), not only in the pages.
Recordings, runs and notes are deleted 180 days after an interview ends, and the candidate's name and email are removed at the same time. An interview nobody finishes ends automatically after 7 days without activity.
An interviewer can delete an interview, and everything recorded for it, at any time.
Candidates are told, before they join, that the session is recorded and for how long.
Interviewer notes are private to the interviewer.

AI is optional and off by default for each interview. Sending a session to an AI provider needs the interviewer's consent, which can only be given before the candidate joins, and candidates are told when it is on.
Session summaries use the final code, the question and the run results, never a candidate's name or the interviewer's notes.
AI requests that carry candidate data go only to the providers we have chosen, and spending is capped each month.

A strict Content-Security-Policy with a fresh nonce on every request: only our own scripts run.
No advertising scripts, and no third-party fonts or content delivery networks.

These services handle data on our behalf. The privacy policy says what each one sees.

Vercel: Hosts the website and the code-run service.
Railway: Hosts the real-time collaboration server and its Redis.
Supabase: Database and interviewer sign-in.
DigitalOcean: Runs the isolated code sandbox (Judge0).
Upstash: Rate-limit counters for running code.
OpenRouter: Routes requests to an AI model provider when an interviewer chooses "Draft with AI" (a question), "Draft feedback with AI" (from their notes) or, only if they turned on AI analysis for that interview before the candidate joined, "Summarise with AI", or lets a candidate ask for AI hints (also only before the candidate joined); used only then.
Resend: Sends email: an interviewer's invitation to a candidate when they choose "Send invite", a notice to our admins when someone asks for early access, a welcome email with a link to set a password when an admin approves a request, and a password-reset link when someone uses "Forgot your password?".
Zoho: Sends the same email as Resend, when the service is set to use Zoho (an invitation, an admin notice, an approval welcome, a password-reset link), and hosts the mailbox that replies to those messages go to.
Vercel Web Analytics and Speed Insights: Page-view counts and page-speed measurements for the website.
Sentry: Error reporting, when it is switched on: tells us that a page, service or request failed, and where.
Cloudflare: DNS for hire-pad.com, and a proxy in front of the website, the code-running service and the code sandbox.

No independent security audit, penetration test or certification (such as SOC 2 or ISO 27001) yet.
Hire Pad is in early access. We fix problems as we find them, but we don't publish uptime figures.