Security
How we protect your data.
VettAI sits between hiring teams and candidates. That puts us in a position of trust. Here is the short version of how we earn it.
Tenant isolation
Every row in our database carries a company id and is protected by a Postgres Row Level Security policy. Company A cannot see Company B's candidates, even if we ship a query bug. Tables are owned by a separate role that cannot be used from web requests.
Encryption
Data is encrypted at rest by AWS KMS (RDS and S3) and in transit via TLS 1.2 or higher. On top of that, PII fields are encrypted at the application layer with AES 256 GCM. We hold exactly one production key at a time, stored in a secrets manager, rotated annually.
Auth and access
Employer logins go through Clerk with SAML SSO support and enforced MFA for admin roles. Session cookies are httpOnly, Secure, and SameSite=Lax. We never handle raw passwords.
AI handling
Candidate text passed to Claude is wrapped in labeled tags and placed in a user role, never concatenated with instructions. The system prompt tells the model to ignore instructions found in candidate content. Responses come back in a schema we enforce. Our consistency check flags mismatches between resume and exercise quality.
Audit and retention
Every admin action writes to an append only audit log with a hashed IP and user agent. Default retention is 24 months after a role closes; each company can configure shorter retention in Settings. Candidate deletion requests cascade through every table.
Reporting
If you find a vulnerability, email security@vettai.example. We acknowledge within two business days and work with you on a coordinated disclosure.