Trust centre

What is true today.

Security pages usually read like wishlists. This one is an inventory: every claim below is either live in the product, in progress, or planned — and labelled as such. When the status changes, this page changes.

Compliance status

In progress

GDPR consent flow

Consent and review-before-publish are live. Export and deletion requests enter a durable queue and are fulfilled through a documented manual privacy process while automated fulfilment is being built.

Live

EU data residency

Application data is stored in EU data centres and the voice runtime runs in EU regions. Model providers are listed openly under subprocessors.

In progress

SOC 2 Type II

Readiness work is underway. You will not see a badge anywhere on this site until the report exists.

Planned

ISO 27001

Scoped to follow the SOC 2 work. We update the status here as it changes — not before.

Security practices

✓
Row-level security
Customer data tables use row-level policies and explicit tenant filters. Administrative metadata is limited to manager, administrator and owner roles.
✓
Role-scoped access
Interviews are visible only to their assignee until published. Administrative surfaces require administrative roles.
✓
Encrypted transport
All traffic between your browser, our servers and the voice runtime is encrypted in transit.
✓
Rate-limited APIs
Sign-in and API endpoints are rate-limited to blunt abuse and credential stuffing.
✓
Consent-gated publishing
Nothing an employee says in an interview reaches their organisation until they have reviewed and approved the transcript.

Subprocessors

These providers process data so AiAx can run. Each receives the minimum it needs for its purpose.

ProviderPurposeRegion

SupabaseDatabase, authentication and file storageEU

VercelWeb application hostingEU / global edge

Google Cloud RunVoice runtime hostingEU

OpenAISpeech and language processing during live interviews and transcript analysisGlobal

Google GeminiFallback speech processing for live interviews (not active by default)Global

OpenRouter (xAI Grok)Company Brain answer composition, post-interview review assistant and onboarding researchGlobal

AnthropicOptional image and screenshot analysisGlobal

ResendTransactional email and calendar invitationsEU / global infrastructure

TavilyOptional web research requested during onboardingGlobal

FirecrawlOptional extraction of customer-provided public URLsGlobal

Upstash RedisAbuse prevention and rate limiting using short-lived technical identifiersEU

The documents behind this page — the full privacy policy and the terms of service.