Security and privacy. Built for the questions your legal team will actually ask.
Candidate data is the most sensitive thing we touch. This page describes what happens to it, who else sees it, and which commitments are enforced in code rather than promised in a policy document.
Interviews are recorded, audio and video.
Every interview is recorded, audio and video, and the candidate agrees to that in the lobby before anything is captured. Recording and automated evaluation are separate consents and neither is pre-checked.
The recording is made through LiveKit and stored in Cloudflare R2. The people at the employer who are authorised to see the report review it with the transcript. The scoring engine never receives it: evaluation is given the transcript as text and, for System Design interviews, the final whiteboard as text, and nothing analyzes faces, expressions, emotion or gaze.
| What is recorded | Audio and video of the interview |
| Who can review it | The employer’s authorised people, with the transcript in the report |
| Where it is stored | Cloudflare R2, recorded through LiveKit |
| How long it is kept | 12 months by default, configurable down to 30 days by the employer |
| Deletion | A candidate can ask for it to be deleted, completed within 30 days including backups. What the retention job does and does not reach today is stated in the next section |
The scoring engine cannot see who the candidate is.
Evaluation receives the transcript and the rubric’s dimensions and, for System Design interviews, the final whiteboard as text.
This is also the answer to the first question an employment lawyer will ask you, which is why it is stated here rather than buried in an appendix.
The evaluator receives
- Pseudonymised transcript (CND-7F2A)
- System Design interviews only: the final whiteboard as text, without positions
- Nothing else reaches a real evaluation today
It never receives
- Name, email, phone
- Photo or video
- Voice audio or accent
- School, employer, years of experience
- Resume, application, location or demographics
What is kept, for how long, and how it is destroyed
Retention periods are configurable per organization. What enforces them today is stated plainly below, including where it does not reach yet.
| Data | Default retention | Then |
|---|---|---|
| Recordings, audio and video | 12 months, configurable to 30 days | No automated deletion exists yet. This is the gap we are closing first |
| Transcripts | Same as recordings | Deleted by our retention job |
| Work artifacts | 24 months | Deleted by the same job |
| Evaluations and evidence | 3 years | Retained for defensibility, then deleted by the same job |
| Candidate contact details | Job close plus 12 months | Purged by the same job. Aggregates survive under a pseudonym |
That job runs when we run it, not on an automatic schedule yet, and it does not reach recordings at all today. We are closing both gaps, and this paragraph will say so the day they close rather than the day before.
Media backup windows are held under 30 days deliberately, so that a 30 day deletion promise is actually keepable. A vendor with 90 day backups and a 30 day deletion SLA is telling you two things that cannot both be true.
Things Live will never do
- Train any model on your candidate data. Contractual with Anthropic directly, and with the speech providers through Live’s LiveKit agreement, in both managed and bring-your-own modes.
- Analyze faces, expressions, emotion or gaze. Unreliable, heavily regulated, and unfair. This is a permanent product decision.
- Reject a candidate automatically. Live produces an assessment. A person at your company decides.
- Keep a candidate reputation record across employers. We do not know, and will not tell you, whether someone interviewed elsewhere on the platform.
A permission can be granted at 2am. A missing endpoint cannot.
Each item on that list is absent from the codebase rather than sitting behind an administrative toggle. There is no query that spans customers, and no setting anywhere that turns off human review of a hiring decision.
Support access to your account is read-only, time-boxed to 60 minutes, has candidate contact details masked, and requires a ticket reference. Our staff console is not yet connected to production data, so no member of staff can reach your account through it today; these are the limits that apply when it is.
Who else touches candidate data
Published here, and updated before we start using a new vendor.
| Vendor | Purpose | What it receives |
|---|---|---|
| LiveKit | Realtime media and recording | Audio and video during the session |
| Deepgram | Speech to text | Candidate audio |
| Cartesia | Text to speech | Interviewer text only, generated from the conversation |
| Anthropic | Conversation and evaluation | The conversation as text, during the interview and afterwards for scoring, and for System Design scoring the final whiteboard as text. No name or contact details are sent with either |
| Supabase | Database, authentication, storage | Application data |
| Cloudflare | Recording storage and WAF | Audio and video at rest |
| E2B | Code execution sandbox | Candidate code, no network egress |
| Resend | Transactional email | Candidate name and email |
Enterprise customers can run inference on their own AWS, Anthropic, Azure or Google account. The model provider then becomes their processor rather than our sub-processor, and no candidate data reaches a vendor they have not contracted with directly.
That table covers candidate data. What we collect from someone who is only reading this website is a smaller and separate question, and it is answered in the next section rather than left to be inferred from this one.
What we collect from you for reading this page
Named because it runs, not because we were asked.
| What | How | Who receives it |
|---|---|---|
| Your IP address, the page you asked for, the time, your browser and the page you came from | Ordinary web server request logs. Any site that serves you a page has these | Vercel Inc., who host this site |
| Which pages get viewed, counted in aggregate | Vercel Web Analytics, loaded on every page here | Vercel Inc. |
| How quickly pages loaded and rendered for you | Vercel Speed Insights, loaded on every page here | Vercel Inc. |
| Which pages you view and whether you have visited before | Google Analytics 4, measurement ID G-VKRPDFQZMX, loaded on every page here since 25 August 2026 | Google LLC |
Vercel states that both of its analytics products are cookieless, that they assign you no identifier and write nothing to your browser. We have not independently verified that, so it is written here as their statement rather than as ours. Google Analytics 4 does write to your browser: it sets two cookies, one of them keyed to this property’s measurement ID, to recognize a repeat visit.
We share web browsing information with analytics partners, such as Google.
Our typefaces are served from this domain. Loading a page here does not ask Google, or any other font host, for anything. A webfont request hands the visitor’s IP address to whoever serves it, which is an expensive thing to give away for a typeface, so we pay the bandwidth instead.
If you send us a demo request or start a signup, this site does not put what you typed into a database. It checks the address, hands the request on, and the domain and company name appear in our server logs like any other request. We are saying this here because a form that quietly kept a table of work email addresses would be a system needing its own retention rule and its own line in a notice, and we would rather not have one.
Security posture
| Encryption in transit | TLS 1.3, DTLS-SRTP for media |
| Encryption at rest | AES-256, the standard default of our database and storage providers |
| Tenancy isolation | Postgres row level security, tested on every deploy |
| SOC 2 Type II | Targeted; the observation period has not started and no report exists yet |
| Penetration testing | Annual, third party |
| Recovery | Point-in-time to 35 days, restores tested quarterly |
| Accessibility | WCAG 2.2 AA, audited annually |
Rights we give the candidate directly
| Know before | Told what is assessed, and what is not, before anything records |
| Consent granularly | Recording and automated evaluation are separate, neither pre-checked |
| Decline | A visible route to request a human interview, with no penalty |
| Accommodations | Requested before the session. Extra time is available. Planned assistance signals will suppress time-based ones |
| Access | See their consent record, what was collected, and who accessed it |
| Deletion | Self-service request, completed within 30 days including backups |
| Contest | A documented route to a named human at the employer |
The decline path matters more than it looks. If refusing is not genuinely available, the consent is not consent, and the whole compliance position collapses. Roughly 5 percent of candidates decline, and you should plan for a human path.
Send this to your security team.
DPA, sub-processor register, penetration test summary, SOC 2 status and the bias audit package are available now. The signed SOC 2 report follows once the audit is complete. Most reviews finish in a week rather than a quarter.