Security

Encryption

All traffic is encrypted in transit with TLS, and data is encrypted at rest. Particularly sensitive secrets, such as connected-tool credentials, are additionally encrypted at the application layer with authenticated encryption.

Access control and tenant isolation

• Row-level security in the database plus application-layer organization scoping isolate each tenant's data.
• Least-privilege access controls gate administrative and sensitive actions.
• Enterprise SSO and directory (SCIM) provisioning are supported for customer identity.
• Human-in-the-loop gating on outbound actions taken by the AI agent.

Monitoring and change management

We maintain audit logging with request correlation, error and performance monitoring (configured to scrub personal data), and rate limiting against abuse. Code changes pass automated type, test, and build checks on every change, and dependencies are kept current.

Data handling and privacy

Personal data is processed under our Privacy Policy and Data Processing Addendum, shared only with the sub-processors we disclose, and retained per our Data Retention & Deletion Policy. Candidate assessment content is not sold and is not used to train general-purpose AI models for unrelated purposes.

Compliance status

Incident response and breach notification

We maintain an incident-response process and will notify affected customers without undue delay of a personal-data breach affecting their data, consistent with our Data Processing Addendum and applicable law, to support their own notification obligations.

Reporting a vulnerability

We welcome reports from security researchers. Please see our Vulnerability Disclosure policy, or email contact@emergences.ai.