Assurance status
What has been checked, and by whom.
The controls on this page are in the product's code today. None of them has been audited by an independent party yet.
- Certifications
- None. No third-party security certification or attestation has been obtained, and we don't claim one.
- Penetration Testing
- No independent penetration test report is available to share.
- Two-Step Sign-In
- Offered with an authenticator app (time-based 6-digit codes) and required for company admins. Anyone else can turn it on in Profile Settings. Codes work once, wrong codes count toward the account lock, secrets are encrypted at rest, and ten one-time recovery codes cover a lost phone. Text-message codes and security keys aren't offered.
Access control
Each company sees only its own data.
Authorisation happens on the server for every request. Hiding a button is never the only thing standing in the way.
- Passwords
- Stored only as Argon2id hashes, never as typed. New passwords need at least 12 characters with a letter and a number, can't be easy to guess and can't be the account's email address.
- Sign-in protection
- Sign-in is rate limited per network address and checked by Cloudflare Turnstile. After five wrong passwords an account is locked for 15 minutes. The error never says whether an account exists.
- Sessions
- An HTTP-only, Secure, SameSite cookie that page scripts can't read. The server keeps only a hash of it. A session ends on sign-out, after 24 hours without use, or after 48 hours at most.
- Company separation
- Every request is checked on the server against the caller's session, company and permissions before any data is read. Browsers have no direct access to the database: Row Level Security is on for every table and all access goes through the server.
- Roles and permissions
- Company admins, recruiters and interviewers each have a set of permissions, which a company admin can adjust. Permissions can limit someone to the positions and candidates they are assigned to.
- Platform support access
- When KASAUTI IQ staff need to see an account to help, they use a support view that needs a stated reason, lasts at most 30 minutes, and records everything done in it in the audit log.
In the browser
Every page is sent with strict security headers.
Requests that change data must also come from this site; anything sent from another site is refused.
| Header | What It Does |
|---|---|
| Strict-Transport-Security | Browsers use HTTPS only, for two years, including subdomains. |
| Content-Security-Policy | Scripts run only from this site with a fresh random value on every request. Plugins, forms that post to other sites and framing are blocked. Cloudflare's check is allowed on the sign-in page only. |
| Permissions-Policy | Camera, microphone and screen sharing are allowed only on interview and assessment pages. Location is never allowed. |
| X-Frame-Options | No other site can show these pages inside a frame. |
| X-Content-Type-Options | Browsers don't guess a file's type, so an upload can't run as a script. |
| Referrer-Policy | Other sites see only this site's address, never the full page path. |
Logging and incidents
Changes leave a record that can't be edited.
- Audit log
- Every create, update, status change and permission change is written with who did it, when and from which address. The database refuses to change or delete these rows.
- Server logs
- Passwords, tokens, cookies and signed links are removed before a log line is written.
- Errors
- People see a plain message and a request reference, never a stack trace or database detail.
- Incidents
- We follow a written runbook: find the cause, contain it, revoke affected keys, check the audit log and tell the companies affected.
Services We Use
KASAUTI IQ is built on these services. Each one is used only for the part of the product listed.
- SupabaseDatabase and file storage
- LiveKitVideo calls, recording and live transcription
- Anthropic (Claude)AI drafts, when a company uses the AI features
- Judge0Running code from the interview code editor
- ResendInvitation, reminder and notification emails
- Cloudflare TurnstileThe security check on the sign-in page
Report a Vulnerability
If you think you've found a security problem, email hello@kasautiiq.com or use the contact form. Include the page or address, what you did and what you saw. Please don't access other people's data, and give us time to fix the problem before you share it.