Where the interview lives
This page is the specific version of the claim on the front page. It lists every field we store, names every company that touches your audio, and says what we cannot do even if asked.
The short version
Transcripts, evidence quotes, candidate names, notes and submittals are written to the recruiter's own computer and are never uploaded. What reaches our servers is counts and durations. Audio is sent, in short chunks, to a speech-to-text provider while the interview runs, and is not retained by them or by us.
What is stored on our servers
One row per interview, with exactly these fields and nothing else:
| Field | Example | Why |
|---|---|---|
| interview id | a random identifier | so a retry does not create a second row |
| organisation, seat | your agency, which recruiter | the coverage report is per recruiter |
| role id, kit version | which question set was used | so a report can say which version of a kit was run |
| source | video, phone or in person | coverage differs by format |
| started, ended, duration, paused seconds | 47 minutes, 65 seconds paused | the time-saving claim is measurable |
| consent acknowledgement, jurisdiction | notice read aloud, California | a record that the decision was made |
| questions total and covered | 11 of 12 | coverage |
| must-asks total and covered | 4 of 4 | the number that matters most |
| follow-ups shown and used | 18 shown, 5 used | coaching |
| scorecard areas and areas scored | 6 of 6 | completeness |
| fit score | 7.5 | one number, no text |
| submittal exported, export kinds | true, Word and email | whether the interview finished properly |
| app version, operating system | 0.9.0, Windows | so a fault can be tied to a build |
That table is the whole of it. The API refuses any request that carries a field outside that list, and the database table it writes to has no free-text and no document column at all — every column is a number, a date or a short label. Two independent mechanisms, because a promise that depends on one of them being maintained is not a promise.
What never leaves the recruiter's computer
- The transcript of the interview, in full
- Every evidence quote on the scorecard
- The candidate's name and any notes typed about them
- Their CV, if one was attached — it is stored with the interview on that machine
- The submittal, in every format it is exported to
- The audio itself — it is never written to a file at all
These are written to a folder in the recruiter's own user profile. They can open it, copy it, back it up or delete all of it from Settings. Deleting is immediate and unrecoverable, and there is no copy anywhere else.
What happens to the audio
While an interview runs, the app sends short chunks of audio to be transcribed and receives back text. The chunk is processed and discarded; nothing is stored by us at any point, and no audio file is ever created on disk.
Transcription is served by Groq, with OpenAI as the fallback when Groq is rate-limited or unavailable. Text generation — the question kit, the follow-ups, the scorecard reasoning and the submittal — runs on Cerebras, Groq and OpenAI depending on the task. All three are used under their paid API terms, under which submitted data is not used to train models.
Subprocessors
| Who | What they handle | Where |
|---|---|---|
| Groq | speech to text, and some text generation | United States |
| OpenAI | text generation, speech-to-text fallback | United States |
| Cerebras | text generation for live suggestions and scoring | United States |
| Vercel | hosting for the API | United States |
| Supabase | the database holding the table above | United States |
| Cloudflare | this website and the download files | Global edge |
| Stripe | payments — they hold the card, we never see it | United States |
| Resend | sign-in links and the weekly report email | United States |
Encryption and access
- Everything in transit uses TLS. The app talks to one host and nothing else.
- The database is reachable only by the API, with a service credential. There is no public key and no client-side database access of any kind.
- Sign-in has no password. A magic link proves an email address; the app then holds a seat token in the operating system's keychain, never in a plain file.
- Removing someone from your team signs them out within sixty seconds, on every machine they were signed in on.
Deleting things
- Interview content: Settings, then "Delete all local interviews". It is on the recruiter's machine, so it is theirs to delete, immediately.
- Your account: email [email protected] and we remove the organisation, its seats and every metadata row within seven days.
- A candidate asking what you hold about them: we hold nothing that identifies a candidate. There is no name, no contact detail and no interview content in our systems, so there is nothing for us to return or erase. What your agency holds on its own machines is yours to answer for.
What we cannot do
We cannot read an interview. Not for support, not for debugging, not on request. The content is not somewhere we can reach — it is on a computer we have no access to. If you report a fault, the diagnostics the app can send contain the application log and your machine's details, and no interview content at all.
Reporting something
Security issues: [email protected]. We reply within two working days and we will not threaten anyone who reports a genuine issue in good faith.
A data processing agreement is available — email [email protected] or read the summary.
Last updated 10 September 2026. This page describes what the software actually does; if you find something here that is not true of the build you are running, tell us and we will correct the page or the software the same week.