Try for free

Security Policy

Effective Date: October 27, 2026

At InterviewStep, we take the protection of customer data extremely seriously. This Security Policy describes the organizational and technical measures InterviewStep implements platform-wide, designed to prevent unauthorized access, use, alteration, or disclosure of customer data.

Overview

InterviewStep services operate on Amazon Web Services (AWS), Cloudflare R2, Railway and Vercel. As you continue to learn more about InterviewStep, we recommend you also review our Terms of Service and Privacy Policy.

Security Team

Our team includes people who have played lead roles in designing, building, and operating highly secure Internet-facing systems at companies ranging from startups to large public companies including Tesla, AWS, and BMW.

Best Practices

Incident Response Plan

  • We have implemented a formal procedure for security events and have educated all our staff on our policies.
  • When security events are detected they are escalated, and our team is notified and assembled to rapidly address the event.
  • After a security event is fixed we write up a post-mortem analysis.
  • The analysis is reviewed in person, distributed across the company and includes action items that will make the detection and prevention of a similar event easier in the future.

Build Process Automation

  • We have functioning, frequently used automation in place so that we can safely and reliably rollout changes to both our application and operating platform within minutes.
  • We typically deploy code many times a day, so we have high confidence that we can get a security fix out quickly when required.

Authentication

  • Access to our cloud services is protected with strong passwords and two-factor authentication.
  • User authentication is handled through Firebase Authentication with support for email/password and Google sign-in.

Infrastructure

  • All of our services run in the cloud. InterviewStep does not run our own routers, load balancers, DNS servers, or physical servers.
  • We have services and data hosted in Railway facilities and protected by Railway security.
  • We have services hosted on Vercel and protected by Vercel security.
  • We use Cloudflare R2 for object storage with enterprise-grade security.

Application Monitoring

  • All access to InterviewStep applications is logged.
  • Actions taken on production consoles or in the InterviewStep application are logged.

Data

  • InterviewStep data is primarily hosted in Railway and AWS facilities in Europe.
  • Customer data is stored in PostgreSQL databases with strict access controls.
  • Customer documents and media files are stored in Cloudflare R2 with encryption at rest.
  • Each InterviewStep system used to process customer data is adequately configured and patched using commercially-reasonable methods according to industry-recognized system-hardening standards.
  • InterviewStep engages certain subprocessors (AWS, Railway, Cloudflare, Vercel, OpenAI) to process customer data.

Data Transfer

  • InterviewStep is served 100% over HTTPS.
  • All data sent to or from InterviewStep is encrypted in transit using TLS 1.3 with 256-bit encryption.
  • Our API and application endpoints are TLS/SSL only.
  • We encrypt all sensitive data using an industry-standard AES-256 encryption algorithm.

AI Model Processing

We utilize OpenAI's GPT models and Anthropic's Claude models for AI-powered features. Customer data sent to these services is:

  • Transmitted over encrypted connections
  • Not used to train AI models (per our agreements with AI providers)
  • Subject to the privacy and security policies of these providers
  • Processed in compliance with GDPR and other data protection regulations

Customer Responsibilities

  • Managing your own user account and organizations on InterviewStep.
  • Protecting your own account and user credentials by securing your email when accessing InterviewStep services.
  • Compliance with the terms of services agreement with InterviewStep, including with respect to compliance with laws.
  • Promptly notify InterviewStep if a user credential has been compromised or if you suspect possible suspicious activities that could negatively impact the security of InterviewStep services or your account.
  • You may not perform any security penetration tests or security assessment activities without the express advance written consent of InterviewStep.

Compliance

InterviewStep is committed to maintaining compliance with relevant security and privacy standards:

  • GDPR (General Data Protection Regulation) compliant
  • Working towards SOC 2 Type II certification
  • Swiss data protection regulations compliant

Security Updates

We continuously monitor and update our security measures. For the latest information about our security practices, please contact us at security@interviewstep.io.

Contact Information

For security-related inquiries or to report a security vulnerability, please contact:

InterviewStep
c/o M. Brenner
Weinbergstrasse 45
8006 Zurich
Switzerland
Email: help@interviewstep.io

Last updated: October 27, 2026