Data classification
Sensitivity tiers and how each class is protected in production. This describes engineering controls, not legal or compliance certification.
Summary
| Data type | Sensitivity | Protection |
|---|---|---|
| Candidate name, email, location, profile | PII | Tenant-scoped API; email plaintext for lookup |
| Candidate phone | PII (higher) | AES-256-GCM field encryption in MongoDB |
| Resume file | PII | Private S3; presigned HTTPS URLs only; SSE-S3 at rest |
| Resume extracted text | PII | MongoDB; omitted from default candidate queries; copied into interview snapshots |
| Team user name, email | PII | Tenant-scoped API; Firebase for auth |
| Passwords, join/invite/session tokens | Credentials | Hashed (SHA-256); plaintext only in email/link at send time |
| Transcript, AI report, proctoring | Sensitive | Tenant-scoped queries; no field-level encryption |
| Recordings, room URLs | Sensitive | Stored on interview document; access via authenticated flows |
| Org settings, positions, notes | Internal | Tenant-scoped; notes soft-deletable |
| Credit ledger, balances | Internal / financial | Tenant-scoped; ledger append-only |
| Health check, public web config | Low | No tenant or candidate content |
Encryption
- In transit: HTTPS for browser, API, S3, and Atlas; secure headers on API responses.
- At rest (app): Field encryption on candidate phone only (
enc:v1:prefix, key fromFIELD_ENCRYPTION_KEY). - At rest (infra): Atlas TLS; S3 default encryption on the resume bucket.
- Hashed, not encrypted:
passwordHash,joinTokenHash,inviteTokenHash,accessPasswordHash,candidateSessionHash. - Logging: Structured logs redact common PII paths; do not log tokens, resume text, or full LLM payloads.
See Data lifecycle for retention and deletion behavior.