Security
Security overview
A summary of how the Psych-Fit platform protects employer and candidate data. Suitable for early-stage commercial and pilot conversations.
EU data residency
All production data is stored in the European Union (Stockholm region) on AWS-backed managed infrastructure.
Managed PostgreSQL
Application data lives in a managed PostgreSQL cluster with automated backups and point-in-time recovery.
Row-Level Security
Every multi-tenant table enforces row-level security so an employer can only query their own roles, invites and candidates.
Employer data isolation
Workspaces are logically isolated. There is no API endpoint that exposes candidates or assessment results across organisations.
Private CV storage
Uploaded CVs are stored in a private storage bucket. Access is mediated by short-lived signed URLs scoped to the invite.
Encryption in transit
All client and API traffic is served over HTTPS/TLS. Database connections are encrypted.
Secrets handling
Service-role keys and third-party credentials are stored as server-side secrets and never shipped to the browser bundle.