Security
Where candidate data goes, and who can reach it
Effective 10 September 2026
Candidate data is the most sensitive thing a recruiting tool holds. This page is the precise version of what the landing page says: how workspaces are isolated, where credentials live, what is logged, and which third parties are involved. Report a vulnerability to security@vizio.ai.
Tenant isolation
Every tenant table carries a workspace identifier. Postgres row-level security policies resolve the caller's active workspace on the database side and refuse rows that belong to any other workspace, so a client can only ever read the workspace it is currently in. Server code that acts on data first resolves the caller's membership and role through a single set of guards and scopes every query to that workspace. Platform staff access to a customer workspace is possible for support and is written to an audit trail each time.
Credentials and secrets
- ATS API keys and Google refresh tokens are stored per workspace in a private database schema that no client role can read; only the service role, used by server code, can reach it.
- The app shows whether a credential is configured, never the value.
- Google is connected through one platform OAuth application; each workspace holds its own token and the OAuth state is signed so a workspace cannot be attached to someone else's mailbox.
- Nothing prefixed as a public build variable is a secret; server secrets are only ever read at request time on the server.
Access control
- Roles per workspace: owner, admin, recruiter, hiring manager, viewer, member and freelancer (own profile only), and alumni (record kept, no access).
- Being invited and being activated are separate steps; an invited address sees no data until an admin activates it.
- Sign-in is by Google or email and password through Supabase Auth. Platform staff can ban an account, which stops sign-in and session refresh immediately.
Audit trails
Invitations, acceptances, role changes, activation, removals, super-admin grants, bans and support access are written to an append-only auth audit trail. Every action taken with platform-staff rights, including billing changes and support access into a workspace, is written to a separate platform audit trail. Both are written by server code only and can be provided to a customer on request.
AI and enrichment
To score an application, the résumé and cover letter text and the role's requirements are sent to the configured language model and the response is stored in the workspace. The model provider does not train on this input. Enrichment sends a candidate's name and professional identifiers to a web search provider and stores the public results. Every score is displayed with the evidence behind it and is advisory; a person makes each stage decision.
Sub-processors
| Provider | Location | What it receives |
|---|---|---|
| Supabase | Frankfurt, Germany (EU) | Postgres database, authentication, file storage for résumés and photos |
| Vercel | Global edge; functions in EU/US regions | Application hosting and server functions; no persistent data |
| Language model provider | Per platform configuration | Résumé and cover letter text with role requirements, for scoring. No training on the input. |
| Exa | United States | Public web search for candidate enrichment (name, professional identifiers) |
| Per Google's regions | Sign-in, and Gmail and Calendar actions the workspace performs through its own connected mailbox | |
| Unipile | European Union | LinkedIn account connection for workspaces that enable sourcing campaigns |
| Your applicant tracking system | Your vendor's region | The source and write-back target of the mirrored pipeline (HRPanda today) |
Data lifecycle
- Deleting a candidate, a workspace or an account cascades through the related rows.
- Suspending a workspace hides it from its members without deleting anything.
- Backups expire on the hosting provider's retention schedule after the source row is deleted.
- Data exports are available on request.
Reporting a vulnerability
Email security@vizio.ai with steps to reproduce. We acknowledge within two business days and will keep you informed until it is resolved. Please do not test against workspaces you do not own.
Vizio AI keeps this page current when the architecture changes; the effective date above is the last review.