ProductInteractive demoAPISecurityPricingFAQSign in
Security and data

Specific about what we do. Honest about what we do not.

How accounts, recordings, identity checks and failures are handled, and the things we have not yet done.

Last updated29 October 2026StatusEarly-stage service
01

How we think about it

Interview recordings and ID checks are sensitive, so we try to make failures visible and keep data in as few hands as possible. This page lists what we do and, just as plainly, what we have not done yet.

What we do

  • Hash passwords and API keys
  • Expire candidate links
  • Keep recordings private
  • Throttle password guessing
  • Email you when sign-in details change
  • Delete video on a schedule

What we have not done yet

  • Independent security audit or certification
  • Published penetration-test report
  • Webhooks for the ID check (we poll for the result)
  • Testing at large scale on real devices and networks
02

Accounts and keys

Passwords
Stored as one-way hashes. Changing a password needs the current one, and repeated wrong guesses are temporarily blocked.
Email changes
A confirmation link, valid for a limited time, is sent to the new address. We also notify the old one.
Notices
Account changes trigger an email to the account owner so an unexpected change is noticed.
API keys
Shown once and stored only as a hash. Revoke a key at any time. Test keys and live keys are separate.
03

Candidate links and recordings

Links
Each candidate link carries a random token. We store only a hash of it, and it stops working at the expiry date.
Recordings
Saved in private storage. A recruiter views a recording through a link that stops working after an hour.
Progress
Video is uploaded in small numbered pieces and saved as it goes. The server counts what arrived, and any gap is shown on the report.
Late uploads
Pieces are accepted for 15 minutes after the session ends, then refused.
04

Identity checks

When a recruiter turns on the ID check, the candidate scans their ID and takes a selfie with our identity provider. The face must match the ID photo, and the name on the ID must closely match the name the recruiter invited. A name that does not match sends the candidate to the recruiter for review, whatever else passed. This closes the gap where someone with a genuine ID takes an interview for another person.

05

When something fails

Recording lost
The report says "Recording incomplete" with the seconds and percentage lost.
Monitoring lost
The report says monitoring data was lost, shows no integrity score, and recommends a review instead of showing a clean result.
Stuck processing
A background job runs every five minutes and finishes or re-runs anything stuck.
ID check fails
The recruiter's policy applies: flag and continue, hold for review, or block after three tries. The candidate is never told why.
06

Retention

Video is deleted after 14, 30 or 90 days depending on plan. The transcript, scores and integrity report remain on the candidate's record. The privacy policy has the full table.

07

Providers

Storage and speech run on Amazon Web Services, language and transcription tasks on Groq, Google and OpenAI, ID checks on VeriKit, and payments on Paystack. The privacy policy lists what each one receives.

08

Report a problem

If you think you have found a vulnerability or a leak, write to hello@intervue.ai with what you saw. Please give us a reasonable time to fix it before sharing details, and do not access other people's data to prove a point. We will acknowledge your report and keep you informed.

Questions about any of this?

Write to us and a person will answer. If you are a candidate, you can also ask the company that invited you.

Email hello@intervue.ai