Candidate data protection and CCPA compliance
Interview recordings are personal data. We process them under the CCPA/CPRA and applicable U.S. privacy law, host them in secure U.S. data centers, encrypt everything, and tightly control access — so candidate data stays protected at every stage
Processing as a service provider (under your instructions)
TalentMind acts as a service provider (processor) and handles data strictly on the client's documented instructions: the client is the business responsible for the candidate's notice and consent. A Data Processing Addendum (DPA) is signed with every client, and we provide guidance on collecting valid consent in line with the CCPA/CPRA
Data residency in the United States
Personal data is hosted in secure U.S. data centers, so candidate data stays within the United States. Regular encrypted backups; for Enterprise — a dedicated, isolated environment in the region of your choice
Encryption in transit and at rest
All traffic is protected with TLS 1.2+/HTTPS, and data is encrypted at rest with AES-256. Encryption keys are managed in a dedicated KMS/HSM, with regular rotation and strict access separation
Biometrics and explicit consent
Audio and video recordings of interviews are personal — and in some cases biometric — data. We process them only with the data subject's explicit consent, in line with the CCPA/CPRA and applicable state biometric privacy laws. Recordings are isolated per tenant and accessed strictly on a need-to-know basis
Access control and audit
Role-based access control (RBAC) following the principle of least privilege, with two-factor authentication for administrators. Every data operation is logged, and we support consumer privacy rights — access, correction, and deletion
Certified infrastructure and response
Our practices align with ISO/IEC 27001 and SOC 2 Type II. Vulnerability management, regular updates, continuous monitoring, and an incident response plan with breach notification in accordance with applicable U.S. state laws
Need a security review for your team?
We'll send our security documentation, a Data Processing Addendum (DPA), a candidate consent form, and answer any questions from your information security team
Contact us