Trust and security

What we do to protect your people’s data, stated plainly. If something here is not yet true for us, it says so.

Certifications and audits

• SOC 2 Type IINot yet issued. We keep a control register and collect evidence for an independent audit. Ask us where we are.
• Penetration testNot yet completed. We will share the summary when it is.
• AccessibilityBuilt to WCAG 2.2 AA and tested automatically; an independent audit is planned.

How we protect data

• Every company’s data is kept apart in code and checked by automated tests.
• Staff must use two-factor authentication; single sign-on with your own identity provider is available.
• HTTPS everywhere, strict browser security headers, and rate limits on sign-in and public pages.
• Tax and bank details, API secrets and sign-in secrets are encrypted, masked on screen, and shown only through a logged action.
• Uploaded files are checked and are viewed inside the app, not through public links.
• An audit trail of sensitive actions that your administrators can export, with a checksum.
• Regular access reviews, kept as records.
• Backups: being put in place; a restore test is required before launch.

Your data, your control

• You choose how long candidate records, video answers and the audit trail are kept, within the limits of US law.
• Candidates can download or delete their own data.
• When you leave, we hand back everything in a standard format and then delete it.
• AI features are off until you switch them on, only draft and explain, and never decide anything.

Where data is stored

This service is hosted in United States. Regions available to customers: United States.

HIPAA

If you will keep protected health information in the service, you must sign our business associate agreement first. Once it is in force, two-factor sign-in is required for all staff, idle sessions end after 15 minutes, and AI features are switched off for your company.

Security questions or a questionnaire to complete: support@prismmstudios.co.in. To report a vulnerability, see security.txt. Sub-processors.