Security & Trust

Certification status

SOC 2 Type II roadmap

We are pursuing SOC 2 Type II across Security, Availability, and Confidentiality trust service criteria. The timeline below reflects our current plan.

Current security controls

Transport & application hardening

• HTTPS enforced on all endpoints with HTTP Strict Transport Security (HSTS, max-age 2 years, includeSubDomains, preload)
• Content Security Policy (CSP) restricts script, style, frame, and connection sources to an explicit allowlist
• X-Frame-Options: DENY prevents clickjacking across all pages
• X-Content-Type-Options: nosniff prevents MIME-type sniffing attacks
• Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy enforce same-origin boundaries

AI data security (prompt injection defense)

• All user-controlled text (messages, résumés, job descriptions) is wrapped in XML boundary tags before interpolation into AI system prompts, instructing the model to treat that content as data, not as instructions
• A security preamble is prepended to every AI system prompt, explicitly instructing the model to disregard prompt override attempts (e.g., “ignore previous instructions”, “reveal the system prompt”)
• Input length limits and control-character stripping are applied before any user text reaches the AI layer

Rate limiting

• Database-backed rate limiting applied to all candidate and manager conversation API endpoints
• Rate limits enforced per-IP and per-identity; limits survive application restarts because state is stored in Supabase

Audit logging

• Key actions (position changes, candidate status transitions, scoring) are written to an append-only audit log with actor, timestamp, resource, and organization context
• Audit log records are stored in Supabase and isolated to the organization that owns the data

Access controls

• Row-level security (RLS) enforced at the database layer: managers can only access positions and candidates they own
• Candidates receive single-use access tokens scoped to their own interview only
• Admin access is restricted to notanATS staff with a documented need
• API keys and credentials are never stored in plaintext

Data encryption

• All data encrypted in transit via TLS 1.2+
• All data encrypted at rest in our database (Supabase AES-256)

AI data processing

notanATS uses Anthropic's Claude API to conduct and evaluate candidate screening conversations. Candidate interview responses are transmitted to Anthropic for processing:

• Anthropic's API usage policy explicitly prohibits using API inputs and outputs to train or improve its models
• Data sent via the API is not retained by Anthropic beyond the duration required to generate a response
• Scores, evaluations, and interview transcripts are stored in our own database (Supabase) under your control, not retained by Anthropic

Review Anthropic's data usage policy at anthropic.com/legal/privacy.

Third-party infrastructure

Incident response

If we confirm a security incident affecting your data, we will notify affected users within 72 hours via the email address on your account. The notification will include:

• What data was affected
• What we have done to contain the incident
• What you should do next

Enterprise & DPA requests

For enterprise procurement, vendor security questionnaires, or Data Processing Agreement (DPA) requests, email security@notanats.com. We respond to enterprise security reviews within 2 business days.

Our standard DPA covers:

• Data controller / processor roles and responsibilities
• Sub-processor list (Supabase, Vercel, Anthropic, Stripe, Sentry)
• Data retention and deletion obligations
• Breach notification commitments (72-hour notification)
• International data transfer mechanisms

Vulnerability reporting

Found a security issue? Email security@notanats.com. We acknowledge receipt within 48 hours and keep you informed as we investigate. We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to address it.

More information

For details on how we collect and use data, see our Privacy Policy. For all security inquiries: security@notanats.com