Security
Interviews are personal. Here is where the data lives, who can see it, and how we keep it that way. No badges we haven’t earned.
Servers and database run on Google Cloud in Mumbai.
HTTPS everywhere, and data is encrypted at rest by our cloud providers.
Everyone signs in with a one-time email code. Nothing to leak or reuse.
Every query is scoped to your company. Nobody else can see your candidates.
Recordings and documents open only through links that expire within minutes.
Admins manage the team and settings. Members review candidates.
Status changes and staff actions on your account are logged.
Strict transport security, no framing, locked-down browser permissions.
In detail
Companies and candidates sign in with a six-digit code sent to their email. Codes are stored hashed, expire after 10 minutes and stop working after five wrong guesses, and requests are rate-limited per email address and per network. Session tokens are stored only as one-way hashes, so a copy of our session store can’t be used to sign in. Company and candidate sessions are kept apart, even in the same browser.
During an interview, the candidate’s browser talks to OpenAI directly using a short-lived key issued for that one session. Our servers never hand out a long-lived key. The transcript is saved as the interview happens, and the recording is uploaded to private storage when it ends.
A small number of LessRounds staff can administer accounts, for example to raise an interview limit or suspend abuse. Staff sessions expire after 12 hours, and changes we make to a company are logged. We look at candidate data only when you ask us to help with something specific.
Recordings are kept for up to 3 years. To have a candidate’s data or your whole account erased sooner, email privacy@lessrounds.ai and we’ll delete it. Database backups age out on their normal schedule.
Subprocessors
These are the companies that help us run LessRounds. This is the full list.
| Service | What for | Where |
|---|---|---|
| Google Cloud | Application servers, database, background jobs and secret storage | India (Mumbai region) |
| Cloudflare | Website hosting and delivery; storage of interview recordings and uploaded documents | Global network |
| OpenAI | Runs the spoken AI interview, transcription, scoring and question drafting | United States |
| Redis Cloud | Sign-in sessions, one-time codes and live interview state | Cloud region, available on request |
| Resend | Sends sign-in code emails | United States |
| HyperDX | Error and performance monitoring | United States |
Full details, including what data each one handles, are on the subprocessors page.
Not yet. We’d rather tell you that than imply otherwise. The controls on this page are what we run today. If your security review needs more detail, ask us.
OpenAI’s policy is that data sent through its API isn’t used to train its models unless the customer opts in. We haven’t opted in.
Up to 3 years, or less if you ask us to delete it sooner. Candidates can ask you, or us, for their data to be deleted.
Yes. Our DPA applies automatically when you use LessRounds. If you need a signed copy, email us.
Email support@lessrounds.ai with “Security” in the subject. A person reads every report. Please don’t test against other companies’ data.
Start with 10 free interviews a month. No card, no sales call.