Security

Built for the procurement question.

Riviot processes career-defining personal data and commercial hiring decisions. We treat both as we expect to be treated — with explicit access control, audit logs on every action, and conservative defaults.

Encryption

TLS 1.2+ in transit. AES-256 at rest via Neon Postgres. Headshots encrypted at rest in Vercel Blob.

Access control

JWT-signed sessions in httpOnly cookies. Role-based access (Candidate / Reviewer / Super Admin / Employer Admin / Hiring Manager). Server-side checks on every mutation.

Audit logs

Every reviewer action and every state change writes an immutable AuditLog row with actor, entity, action, and metadata. Retained 7 years.

Architecture overview

Application: Next.js 14 on Vercel (US-East). All routes are TLS 1.2+ with HSTS preload.
Database: Neon Postgres. EU/UK regions available. Point-in-time backups (rolling 30 days).
File storage: Vercel Blob for headshots. Public-readable URLs only when the candidate has explicit photo-consent enabled.
AI processing: Anthropic Claude. We send pseudonymised assessment payloads — never your direct contact details — and rely on Anthropic's enterprise data-handling commitments (no training on your data).
Email: Resend for transactional email. SPF/DKIM/DMARC fully configured for the riviot.com sending domain.
Payments: Stripe. We never see or store card data.

Application security

Passwords are hashed with bcrypt (cost 10). We never store, log, or transmit plaintext passwords.
Sessions issued as JWTs signed with HS256, scoped to httpOnly + SameSite=Lax cookies. 7-day expiry.
Edge middleware enforces auth and role boundaries before any handler runs.
All mutating handlers re-validate role server-side (never trusting middleware alone).
Input validation via Zod on every API route. Rejected requests log with rate-limited tracebacks.
Stripe webhooks are signature-verified before any state change.
Google SSO uses signed-state cookies for CSRF protection during the OAuth round-trip.

AI safeguards

Vio's AI scoring is reviewer-in-the-loop by design. No candidate is admitted, rejected, or introduced to an employer without a Riviot reviewer's explicit decision.
AI-generated text (fit summaries, talent profile narratives, scenario evaluator notes) is always shown alongside the deterministic signal it augments.
When a Claude call fails or `CLAUDE_API_KEY` is unset, the platform falls back to deterministic logic — never to "skip the check".
We do not use AI to make automated decisions with legal or significant effects on candidates within the meaning of GDPR Art. 22.
Candidate scoring data is sent to Anthropic without your direct contact details (email, phone). Names appear only where contextually necessary for prose generation.

Candidate privacy controls

Visibility: Private / Riviot-only / Available for matching / Available for select clients. Default is Riviot-only until you opt to be matched.
Photo consent: headshots never appear to employers without explicit per-candidate consent.
Pause: you can pause matching with one click in Account → Visibility.
Export: one-click data export (JSON, machine-readable) at Account → Download my data.
Delete: permanent account deletion at Account → Delete my account. Audit data may be retained 7 years for compliance.

Incident response

Suspected security incidents are triaged within 24 hours.
Breach notifications follow GDPR Article 33 (DPA notification within 72 hours) and Article 34 (affected individuals without undue delay where high risk).
Public status page: /api/health for live database/integration status.
Report a concern: security@riviot.com.

Compliance roadmap

Riviot is a seed-stage company. We are not yet SOC 2 Type I or II certified. We are designing the platform with SOC 2 control patterns in mind so the eventual audit is straightforward.

UK / EU GDPR: compliant by design. EU-representative under GDPR Art. 27 to be appointed before EU-customer launch.
SOC 2: not currently in audit. Targeted Type I assessment when revenue and customer commitments support the cost.
ISO 27001: aligned controls, not certified.
HIPAA: not in scope — Riviot does not process protected health information.
Pen tests: first formal pen test scheduled before our first paying enterprise pilot.

We're transparent about what we have and don't have. If your procurement team wants more detail on any of the above, email security@riviot.com and we will share roadmap commitments under NDA.

Sub-processors

The full list of service providers that may process customer data on our behalf is in our Privacy Policy. Material changes are announced 30 days in advance.

Vulnerability disclosure

If you believe you have found a security issue, email security@riviot.com. We acknowledge within one business day, triage promptly, and credit responsible reporters where they wish.