Trust and security

1Our approach

When a company or institution runs interviews or exams on LogicWiz, it stays in charge of its candidates' data. We process that data for it. Our privacy policy says this in the same words, and a Data Processing Agreement is available on request.

We use AI to help with interviews and screening. A person on the hiring team makes the decision. We tell candidates when they are talking to an AI, and we ask for their agreement before a real AI interview starts.

This page covers LogicWiz Interviews in the most detail. For Exams specifics, ask us.

We would rather tell you plainly what we do and do not have than hand you a long list of badges. The rest of this page is written that way.

2Data we handle and where it is stored

Depending on how a company sets up its interviews or exams, we handle:

• Account data: name, email, organization, role, and sign-in details.
• Interview and exam content: questions, answers, transcripts, scorecards, notes and certificates.
• Resume content: see below.
• Integrity records: only for sessions where the hiring team turned checks on. See section 6.
• Usage data: IP address, browser and device type, and logs used to run and protect the service.

Resumes. We keep the text of a resume as structured fields (for example name, skills, work history) and the file name. We do not keep the uploaded file. While a resume is being read, the file is sent to an AI provider to extract and assess it (see section 3).

Recordings. Video answers to asynchronous interviews are stored in a private storage bucket. Only the candidate and authorized staff of the hiring organization can read them.

Where it lives. The product's database, sign-in and file storage run on Supabase. The website and its edge functions are served from Cloudflare Pages. Our privacy policy states that data is encrypted in transit and at rest.

The primary database runs on Supabase in the AWS ap-south-1 region (India). Ask us if you need that confirmed in writing for your review.

3Where AI is used

AI is used in these places. We list what text goes where, so your reviewer does not have to guess.

Candidates can answer by voice or by typing. Voice is turned into text by the speech recognition built into the candidate's browser, so which company handles that audio depends on the browser they use. The text is what we send onward.

If Google's service is busy or rate-limited, our code can route a request to a different model provider, but only one that has been configured, and by default not one whose terms allow the provider to train on the request. The list of providers in use at any time is part of the due-diligence pack (section 9).

Telling candidates and getting their agreement

Before a real AI interview (one set up by a hiring team, as opposed to practice), the candidate sees a notice and must tick a box to continue. It says that:

• Aria is an AI and not a person.
• What is assessed is the content of the answers, compared with the skills the role needs.
• Aria's evaluation ignores face, appearance, accent, tone of voice and emotions.
• Any proctoring checks the hiring team turned on are separate from Aria's evaluation.
• A person on the hiring team reviews the interview and makes the decision.
• Where the data is kept, for how long, and who to write to.

The agreement is saved against that one interview with a timestamp. If the save fails, the interview does not start. A candidate can also ask for an accommodation, a person to review the interview, or an interview without AI. The request is saved with the application, where the hiring team sees it. We do not promise a reply time on the hiring team's behalf.

People decide

AI scores, notes and resume matches are decision support. The product describes Aria's output to candidates as advisory. Resume screening can optionally be set to reject low matches automatically. That setting is off by default and an organization has to switch it on.

4Candidate privacy

Practice is private. A candidate's own practice sessions, scores and resumes belong to their account. They are not shared with any company hiring on LogicWiz. The tools that screen resumes for employers are kept separate from the candidate's resume tools, and a candidate's resume review is not readable by a recruiter, even one whose job the candidate applied to.

What a candidate sees after a real interview. For real interviews the candidate sees the status, date, job title and round. They do not see scores, summaries or interviewer notes. Practice results they do see.

What an employer sees. For a real interview, authorized staff of that organization see the answers, transcript, scorecard and any integrity notes for their own candidates. Staff of other organizations do not (section 5).

5Access control

Every company's data is kept apart from every other company's. Inside a company, what a person can see depends on their role (for example admin, recruiter, interviewer or candidate). The database enforces this itself, so it does not rely only on the app hiding buttons. A staff member who is also the candidate on an interview cannot read the real results of that interview.

Signing in. People sign in with email and password, or with Google where it is enabled. Accounts can add two-factor authentication using an authenticator app (TOTP). An audit log and a consent log are available to organization admins.

Provisioning. A SCIM 2.0 endpoint exists for user provisioning with a bearer token. We do not offer SAML single sign-on today. If SAML is a requirement for you, tell us so we can be straight about timing.

6Integrity signals

Hiring teams choose which integrity checks to turn on for an interview, and the threshold for some of them. Examples are leaving the tab or fullscreen, copy and paste, the camera going dark or being lost, a face missing or more than one face in view, looking away from the screen, another voice, and an ID photo or a room scan.

Face-presence checks run in the candidate's browser. The detector code is downloaded from public code hosts (jsDelivr and esm.sh) when it is needed.

Events are logged with a severity, and the interviewer's view adds them up into a score from 0 to 100 with a label from "Clean" to "High risk". Some events are shown but not counted, such as a candidate using the Ask Aria button that the interview itself offers, or successfully completing an ID check or room scan.

What this does not mean. The panel itself says the score is heuristic and should be combined with live observation, not used as a verdict on its own. A tab switch can be a notification. A missing face can be a poor camera. Treat it as a prompt to look closer, not as a verdict.

Depending on the rules the hiring team set, a session can be ended when a limit is passed. The candidate is told the reason.

For recorded answers we also compute an estimate of whether the text reads as if it was drafted by an AI. It is an estimate. We do not claim it is proof.

Candidates are told about these checks before the interview and have to agree first. Declining means the interview does not start, and nothing is recorded.

7Retention and deletion

Interview recordings (the video and audio files) are deleted 24 hours after the session ends by default. A deleted recording is replaced in the report by a note saying so. Scorecards, scores, written feedback and results are not recordings. They are kept for up to 2 years, and account and invoicing records are kept as the law requires. Our privacy policy states the same periods.

A longer recording window may be offered later as an option agreed with the customer. Ask us if you need one.

Our internal audit log has a scheduled clean-up: anti-cheat audit events are removed after 3 years and other audit events and consent records after 7 years, where the scheduler is available.

Erasure requests. An organization admin can record an erasure request for a candidate and run it. Running it removes the candidate's name, email and account link from the candidate and application records. For anything beyond that, or for a request from the candidate directly, write to the contact below. Candidates can also ask the hiring organization, which is the controller of their data.

Candidate resumes. A candidate can delete a resume they saved in the Resume Optimizer, and its versions and reports are deleted with it.

We do not currently offer a self-service data export. Ask us if you need one.

8Subprocessors

These are the outside services our code uses for LogicWiz Interviews and Exams. The list was built from the code, not from a vendor list. Our privacy policy says a current list is available on request.

Other AI model providers are supported in our code for use when Google is rate-limited (section 3). Ask us which are active.

9Compliance status

LogicWiz does not currently hold a SOC 2 report or ISO 27001 certification. We have not published a third-party audit of our AI scoring for bias.

What exists today:

• Candidate notice and agreement before a real AI interview and before proctoring, saved with a timestamp and visible to the hiring organization in a consent log.
• An audit log of changes made in the product.
• A privacy policy and terms of service, and a Data Processing Agreement on request.
• Role-based access with row-level security, and optional two-factor authentication.
• A process for candidates to ask for an accommodation, a human review, or an interview without AI.

If your procurement needs more, ask for the due-diligence pack. It covers the current list of AI and other providers, data regions, and answers to your security questionnaire. Use the contact form and say "due-diligence pack".

10Contact and reporting a security issue

For sales, procurement and questionnaires, use logicwiz.ai/contact.

Our security contact is [email protected]. Use it for privacy requests and to report a security problem. It is also the address in our privacy policy. Please include what you found, where, and how to reproduce it. Please do not access other people's data while testing.