Security
[LAWYER REVIEW] This page describes the controls that exist today. Do not add certifications, audits or guarantees that have not been obtained.
What we protect
Account data, the offer you submit, the generated site and its passwords. The site is private: a site password opens it, a separate editor password unlocks editing, and the published URL is not indexed as a public marketing page.
Access and secrets
- Passwords are hashed with Argon2; refresh tokens are stored hashed and rotate.
- Deploy secrets live in Infisical (EU) and GitHub/Cloudflare secret stores, not in the repository.
- Operator access is limited to the admin console and is audited; no operator can edit a customer’s site content through the console.
- Site and editor passwords are shown once, in the publishing browser session; they are never placed in a URL.
Hosting and data location
The API, worker, database and Redis run on Hetzner infrastructure in the EU. Generated sites are stored in private GitHub repositories and served by Cloudflare Pages. The subprocessor list and transfer mechanism are on the Privacy Policy and DPA.
Application controls
- Short-lived access tokens and rotating refresh cookies; rate limits on auth and costly actions.
- Server-side ownership checks on every site, generation, suggestion and artifact route.
- Idempotency keys for generation submissions and an append-only credit ledger.
- Structured logs with request ids and secret redaction; no passwords in logs.
- SSRF checks on offer and media URLs; generated content only embeds discovered official media.
Backups and recovery
Database backups are encrypted and access-controlled; the current retention is 30 days. Site content is recoverable from its GitHub repository while it exists. A deleted account is removed through an audited cascade; an incomplete cascade is retried from the operator console.
No live assistance
The product is preparation only. It does not listen to, join or assist a live interview. Using any preparation tool during an interview may breach the employer’s rules and these terms.
Report a vulnerability
Email security@interviewchallenger.com with the steps to reproduce and the impact. Do not access other users’ data, run destructive tests or disclose the issue publicly before we have had a reasonable chance to fix it. We aim to acknowledge within two business days.