Security
Security & data protection
How we protect your data — from the moment you start a practice session to long after you’ve landed the job.
Security controls
Transport encryption
All traffic served over HTTPS with HSTS enforced (max-age 63072000, includeSubDomains, preload). TLS 1.2+ enforced at the CDN layer.
Data at rest
All database data encrypted at rest by Neon (AES-256). Clerk session tokens stored encrypted. No sensitive data stored in plain text.
Authentication
Managed by Clerk — industry-standard OAuth2/OIDC flows, brute-force protection, and session expiry. We never handle raw passwords.
Camera data
Camera video is processed entirely in your browser using MediaPipe. No video frames are sent to our servers. No video is stored.
Voice/audio
Voice transcripts are generated in-browser via the Web Speech API and sent for AI analysis only. Raw audio is never stored or transmitted.
Access controls *
Protected API routes require authenticated Clerk session tokens. Unauthenticated requests to protected endpoints return 401. Rate limiting applied to all AI endpoints.
Security headers
HSTS, X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy (camera/microphone self-only), X-XSS-Protection enforced on all responses.
Dependency management
Dependencies reviewed regularly. Production build runs against locked package versions. Critical CVEs addressed as a priority.
* Two endpoints are intentionally public by design: /tools/star-scorer (free STAR answer scorer, IP-rate-limited to 5 requests per hour) and /api/assessment/[token] (assessment invites issued by hiring teams using single-use cryptographic tokens). Neither endpoint exposes personal candidate data.
Sub-processors
We use the following third-party services to operate the platform. Each is bound by a Data Processing Agreement where required under UK GDPR.
| Processor | Purpose | Location |
|---|---|---|
| Clerk | Authentication and session management | US (EU data stored in EU region) |
| OpenAI | AI analysis of interview answers and transcripts | US |
| Neon | PostgreSQL database (candidate profiles, sessions) | EU (AWS eu-west-1) |
| Vercel | Hosting and edge delivery | Global CDN, origin EU/US |
| Resend | Transactional email (assessment invites) | US |
Your rights under UK GDPR
You have the right to access, correct, export, and delete your data at any time. Most of these actions are available directly from your profile page. For requests we cannot fulfil automatically, contact us at privacy@aicareermentor.co.uk and we will respond within 30 days.
Responsible disclosure
If you discover a security vulnerability, please report it to security@aicareermentor.co.uk with a clear description and reproduction steps. We will acknowledge receipt within 48 hours and work to resolve critical issues as a priority. We ask that you do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.
Need a DPA or security review?
Enterprise customers can request a Data Processing Agreement, our security questionnaire responses, or a compliance call with our team.
Contact enterprise team →