Security and data

1. Where the data lives

Candidate and company data sits in two places:

• Database, accounts, CVs, chat files — Supabase, region eu-west-1 (Ireland, EU).
• Recordings of AI screenings, HR and tech interviews — Google Cloud Storage, region us-central1 (United States). AES-256 at rest, TLS in transit.

To be clear: recordings are currently stored in the US. Moving the bucket to an EU region is planned; this page will be updated when it happens. Live calls run through our own LiveKit server in Frankfurt (europe-west3), where the recording workers and the test-task sandbox also run.

2. Who has access

• Recruiters and admins of your organization. Organizations are isolated at the database level (Row-Level Security): one company’s data is not visible to another.
• A tech lead sees the report and recording of a specific interview only after HR explicitly shares it; the share can be revoked.
• There are no public links to recordings or reports — viewing requires signing in.
• The Talkruit team — only on a support request from your organization, and only as far as needed to resolve it.
• The candidate receives a summary of their AI conversation by email and in their Telegram cabinet.

3. How long we keep it

Recording retention is a setting of your organization, separately for AI screenings, HR and tech interviews: 14, 30, 90, 180 or 365 days. The default is 180 days.

• While the candidate is in the pipeline, the recording is kept.
• Once the candidate is rejected or hired, the recording is deleted automatically after the chosen period.
• A recording the interviewer chose not to keep after the call is deleted after 2 hours.
• Deleting a candidate or an organization deletes all their recordings immediately.
• A single recording can be pinned: it is then never auto-deleted until unpinned. A deletion request overrides a pin.

Thirty days after creation a recording moves to a colder storage class (slower to open, same access). Transcripts and reports stay with the candidate’s card.

4. What the AI does and does not do

Does:

• Runs the voice screening call by your script, asks follow-ups, keeps a transcript.
• Extracts facts from the conversation, checks them against the CV and the job requirements, gives a 0–100 score and a recommendation (invite / maybe / reject) with reasons.
• For recorded HR and tech interviews: a timestamped transcript, skill scores, key moments, first impression. For video interviews it also rates engagement (eye contact, confidence, pauses, energy) — shown as a separate block in the report.
• For test tasks: builds and runs the code in a sandbox and checks the result; during live coding it records integrity signals (code pasting, tab switching, gaze direction).

Does not:

• Does not make the hiring decision. The AI recommendation is input for a person on your team; only a person changes a candidate’s status.
• Does not verify identity (no document or selfie checks).
• Does not train on your data: Gemini is used through Google Cloud Vertex AI, where customer data is not used to train models.
• Does not assess gender, age, nationality or appearance.

Before the AI call the candidate is told that an AI leads the conversation, that it is recorded and transcribed, and that a person makes the decision — and confirms consent.

5. Subprocessors

Services that process data on our behalf:

• Google Cloud — Vertex AI (Gemini), Cloud Storage (recordings), Cloud Run (recording processing, test-task sandbox).
• Supabase — database, authentication, CV and chat file storage (EU).
• Soniox — speech recognition in the live AI screening and on recordings.
• Cartesia — voice synthesis for the AI interviewer.
• Vercel — hosting of the website and dashboard.
• Resend — email delivery to candidates and recruiters.
• Telegram — candidate cabinet and notifications, when the candidate connects the bot themselves.
• Microsoft Clarity — anonymised analytics on the public website pages only, never in the dashboard or on candidate pages.

LiveKit for live calls is self-hosted by us on Google Cloud in Frankfurt. Data is not sold or shared for advertising.

6. Deletion or access requests

A candidate or a company can request a copy or deletion of their data: write to hello@talkruit.space from the address used in the application or account. We respond within 5 business days. Deleting a candidate from the organization’s dashboard removes their recordings immediately; the CV and profile contact details are deleted on request.