Security & privacy
Assessment data is consequential. Our operating standard is to collect what the workflow needs, restrict who can review it, preserve consent and source context, and support deletion through an accountable process.
01 · Data minimization
Campaigns use role, candidate, response, scoring, and report data needed to run the authorized workflow. Customers should not place unrelated sensitive information in job descriptions or candidate notes.
02 · Transmission
Production web traffic and service calls use encrypted transport. Credentials are read from server-side environment variables in server-only modules.
03 · Access control
Portal roles scope each user to their company's workflows through a shared permission layer. Candidate access uses a dedicated invitation-token flow, separate from recruiter and admin sign-in.
04 · Consent & notice
The workflow is designed to present the assessment purpose, expected use, and relevant notice before participation. Employers remain responsible for role relevance, lawful basis, accommodations, and local requirements.
05 · Retention & deletion
Deletion requests are received by the support team, and the code includes an identity-anonymization function. The processing scope and retention period are explained after review.
06 · Human accountability
Theta AI™ and Titan AI™ organize evidence; they do not own the employment decision. Integrity flags and AI-assisted interpretations require review, and customers remain accountable for adverse decisions.
The point
Evidence loses value when its purpose, access, lineage, or retention cannot be explained. Security and privacy controls are part of the assessment system, not a footer promise.
