Trust
Security and data handling
You upload other people's CVs and interview notes, so this page says plainly what we do with them. It lists what is in place today and, at the end, what is not. Last reviewed October 2026.
Who can see your data
- Roles. Teammates are either Recruiters or read-only Viewers. A Viewer is blocked in the database, not just hidden in the screens. Account owners can see an audit log of account-level changes and download it.
- Your account only. Jobs, candidates and feedback are separated per account in the database itself (row-level security), not only in application code. Another customer's account cannot read them.
- Your team, as you set it. Team members see the account owner's data, or only their own work if the owner chooses private mode.
- Rezumz staff can open the admin console to support customers. Every change made there (access grants, suspensions) is written to an audit log.
Interviewer links
Each interviewer gets their own link with a long random token, and must confirm a one-time code sent to their email before seeing anything. A code lasts 60 minutes and allows 5 attempts. After verifying, access lasts 48 hours, and the link itself works for 21 days. Submitted feedback cannot be edited: a change becomes a new version, and the recruiter sees every version. A recruiter can withdraw a link at any time.
Integrations
- API keys are stored only as a one-way hash. We cannot show a key again, only replace it. Keys can be read-only, and revoking one takes effect immediately. The API never returns CV text.
- Webhooks are signed with the open Standard Webhooks scheme, so you can verify they came from us. We only deliver to public https addresses, never follow redirects, and pause an endpoint that keeps failing.
AI processing
When you use an AI feature, the text needed for that request is sent to Anthropic and the result comes back to you. We don't use customer content to train models, and we don't sell or share it for advertising. Candidate scoring is a decision aid for a person: nothing is rejected or emailed automatically.
Sub-processors
These providers process data on our behalf. We'll update this list before adding a new one that handles customer content.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Supabase | Database and sign-in | Accounts, jobs, candidates, interview feedback | United States (us-east-1) |
| Vercel | Application hosting | Requests to the app, including uploaded files while they are processed | United States, with a global edge network |
| Anthropic | AI analysis and writing | The text of a CV, job description or transcript you ask us to analyse, for that request | United States |
| Resend | Email delivery and CV inbox | Interview links, scheduling emails, close-out emails, CVs forwarded to your inbox address | United States |
| Dodo Payments | Payments and subscriptions | Billing details. We never see card numbers. | Set by Dodo Payments |
| Slack | Optional Slack bot | Only if you install it: commands and replies in your workspace | Set by Slack |
| Google Analytics and PostHog | Product analytics | Page views and in-product events. No advertising trackers. | Set by each provider |
Your data, your control
You can export your candidate data and delete jobs, candidates or your whole account. Deleting a job removes its candidates, interview rounds and feedback. To ask for something we can't do from the product, email firststonelabs@gmail.com. A candidate who wants their CV removed should contact the recruiter who uploaded it, or us if that isn't possible. See the privacy policy and the data processing agreement template.
What we don't have yet
A security page that only lists good news isn't worth much. As of today:
- No SOC 2 or ISO 27001 certification. We haven't been audited.
- No single sign-on (SAML). Two-step sign-in with an authenticator app is available to each person, but an account owner can't require it for the whole team yet.
- The audit log covers account-level actions (keys, webhooks, team changes, exports, imports, interview links, close-out). It does not yet record every individual view or edit of a candidate.
- Data is stored in the United States only; there is no EU hosting option.
- The operating entity is not yet incorporated, and our legal documents are drafts a lawyer has not reviewed. If your procurement needs that, ask us first.
Found a vulnerability? Please email firststonelabs@gmail.com with the details and give us reasonable time to fix it before sharing it publicly.