Data Security and Privacy

Security and Privacy in Apikuo

Understanding how Apikuo protects your sensitive hiring data.

Data Encryption

In Transit

• All connections use TLS 1.3 encryption
• HTTPS enforced on all pages
• Secure WebSocket connections
• API calls use encrypted tokens

At Rest

• Database encryption using AES-256
• File storage encrypted on S3
• Backups encrypted and isolated
• Encryption keys rotated regularly

Access Control

Authentication

• Secure password requirements
• Optional two-factor authentication
• Session timeout after inactivity
• Password reset via secure email link

Authorization

• Role-based permissions (Owner/Admin/Member)
• Team-level data isolation
• No cross-team data access
• Audit logs for sensitive actions

AI and Data Privacy

Compliance Standards

GDPR Compliance

• Right to access data
• Right to deletion
• Data portability
• Consent management
• Privacy by design

CCPA Compliance

• California resident rights respected
• Data disclosure upon request
• Opt-out mechanisms
• No sale of personal information

Data Retention

Data Type	Retention Period	Notes
Active Candidates	Indefinite	Until manually deleted
Archived Candidates	2 years	Configurable by team
Interview Notes	With candidate	Deleted with candidate
Audit Logs	1 year	For security purposes
Deleted Data	30 days	Soft delete period

Security Best Practices

For Administrators

• Enable two-factor authentication
• Regular permission audits
• Remove inactive team members
• Use strong, unique passwords
• Monitor unusual activity

For All Users

• Don't share login credentials
• Log out when using shared computers
• Report suspicious activity
• Keep browser updated
• Use secure networks

Data Breach Protocol

In the unlikely event of a breach:

1. Immediate notification within 24 hours
2. Detailed incident report within 72 hours
3. Assistance with regulatory compliance
4. Credit monitoring if applicable
5. Full transparency on impact

Data Export and Portability

Export Your Data

1. Go to Team Settings > Data Export
2. Select data types to export
3. Choose format (CSV, JSON, PDF)
4. Receive secure download link

Data Deletion

1. Individual candidates: Delete button on profile
2. Bulk deletion: Select multiple and delete
3. Full team data: Contact support
4. Account deletion: Settings > Delete Account

Security Features

Third-Party Integrations

Approved Services

• OpenAI: AI processing (no training on your data)
• Stripe: Payment processing (PCI compliant)
• AWS: Infrastructure (SOC 2 compliant)
• SendGrid: Email delivery (secure)

Reporting Security Issues

Found a security vulnerability?

• Email: [email protected]
• Response within 24 hours
• Bug bounty program available
• Responsible disclosure policy