Security is part of every practice session.
Learn about InterviewUp's security architecture, Google Cloud foundation, encryption standards, AI data isolation, and responsible vulnerability disclosure.
Jump to a section
Our Security Approach
At InterviewUp, security and candidate privacy are foundational design principles. We believe that job seekers, software engineers, and professionals practicing for high-stakes interviews deserve complete transparency regarding how their code, voice transcripts, and resumes are protected.
We implement a defense-in-depth architecture that combines modern cloud infrastructure, strict identity governance, client-server isolation, and data encryption. Rather than relying on vague security guarantees, we disclose our actual technical controls so you can evaluate our practices objectively.
- Defense-in-depth: Multiple layers of protective controls across the network, application, database, and cloud layers.
- Principle of least privilege: Access to production environments is strictly limited to authorized personnel with a verified operational need.
- Data isolation: User practice sessions, spoken answers, and resumes are cryptographically segregated and accessible only by the authenticated account owner.
- Continuous improvement: Security practices evolve in parallel with new product features, technological updates, and threat research.
Infrastructure & Cloud Security
InterviewUp is built on Google Cloud Platform (GCP) and Firebase enterprise infrastructure. This foundation ensures that our application benefits from Google's extensive physical security, environmental redundancy, and resilient hardware architecture.
Production workloads are hosted in geographically resilient data centers featuring multi-zone replication, automated failover, redundant power supplies, and round-the-clock physical access monitoring.
- Google Cloud Foundation: Cloud Firestore, Firebase App Hosting, and Cloud Storage run on secure Google Cloud infrastructure.
- Data Center Assurances: Underlying Google Cloud facilities are subject to independent audits verifying compliance with ISO/IEC 27001, SOC 1, SOC 2, and SOC 3.
- Global Edge Delivery: Static assets and web interfaces are cached and served via Google's distributed global content delivery network.
- DDoS Mitigation: Built-in cloud network protection mitigates distributed denial-of-service (DDoS) attempts at the perimeter before they reach application services.
Data Protection & Encryption Standards
We protect your information at every stage of its lifecycle—both while traveling across public networks and when stored in our databases and file systems.
- Encryption in Transit: All network communications between your browser, our web application, and API endpoints are encrypted using Transport Layer Security (TLS 1.3 / HTTPS). Insecure HTTP connections are automatically redirected to secure HTTPS.
- Encryption at Rest: All persistent data stored in Cloud Firestore databases and Firebase Cloud Storage buckets is encrypted by default using advanced 256-bit Advanced Encryption Standard (AES-256) algorithms.
- Secrets & Key Isolation: Server-side API keys, database credentials, and service tokens are managed via secure environment variables and are never bundled into client-side browser code.
Cryptographic Standard
AES-256 is the industry benchmark for symmetric encryption, ensuring that database snapshots, disks, and backups remain unreadable without authorized decryption keys.
Authentication & Identity Governance
Account access and authentication are managed through Google Firebase Authentication, providing enterprise-grade identity protection without storing sensitive plaintext passwords on our servers.
- Salted Password Hashing: User passwords are never stored in plaintext or reversible formats. Firebase Auth protects credentials using a hardened, custom-salted Scrypt hashing function.
- Tokenized Session Security: Upon successful authentication, the application exchanges credentials for short-lived, cryptographically signed JSON Web Tokens (JWTs) that manage session authorization.
- Role-Based Access Control (RBAC): Access to administrative tools and production databases is restricted using fine-grained role-based permissions.
- Session Revocation: Users can terminate active sessions by signing out, invalidating authentication tokens across connected devices.
AI Security & Simulation Privacy
InterviewUp is an AI-powered preparation platform. We understand that candidates share candid interview answers, technical pseudocode, and detailed resumes. Protecting this content from unauthorized AI model training is one of our top priorities.
When you participate in an interview simulation or submit a resume for ATS analysis, your inputs are transmitted to commercial AI inference APIs over encrypted TLS channels. User submissions are processed statelessly solely to generate the requested questions, rubrics, and feedback.
- Zero Model Training on Customer Submissions: Under our commercial enterprise agreements, customer interview prompts, spoken answers, and uploaded resumes are explicitly prohibited from being used to train, retrain, or improve public or foundation AI models.
- Stateless API Processing: Inputs are evaluated in real time to generate rubric scores and recommendations, after which they are discarded by the AI engine according to enterprise data protection terms.
- Advisory Output Notice: AI evaluations and scores are private preparation guides designed for self-improvement and do not constitute formal employment screening decisions on behalf of any employer.
Confidentiality Notice
Your interview answers and resume files are private to your account and are never published, shared with third-party recruiters, or made searchable by search engines.
Payment Security & Financial Data Isolation
InterviewUp offers optional paid subscriptions (such as Pro and Elite plans). To ensure maximum financial security, we completely isolate payment processing from our primary application servers.
All transactions are processed through Razorpay Software Pvt. Ltd., a trusted, global payment gateway certified under the Payment Card Industry Data Security Standard (PCI-DSS Level 1).
- Zero Cardholder Data Storage: InterviewUp never receives, processes, or stores your full credit card numbers, debit card numbers, CVVs, or online banking passwords.
- Tokenized Checkout: Payment details entered during checkout are submitted directly to Razorpay's PCI-DSS compliant checkout modal over encrypted channels.
- Secure Transaction Records: Our servers receive only tokenized transaction IDs, subscription status, and billing cycle dates required to provision your plan access.
Application Security & Development Practices
We follow secure software engineering practices throughout the product lifecycle to prevent vulnerabilities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and injection attacks.
- Strict Input Validation: All form inputs—including contact forms, profile fields, and free-text interview answers—are validated and sanitized on both the client and server.
- Server-Side API Boundaries: Public web routes communicate through dedicated Node.js server boundaries (such as /api/contact) to shield internal service endpoints from direct public exposure.
- Continuous Dependency Auditing: Application dependencies are audited regularly using automated security scanning to detect and remediate known vulnerabilities in open-source packages.
- TypeScript Strictness: The entire application codebase is strictly typed with TypeScript, eliminating large classes of runtime type errors and data manipulation defects.
Security Monitoring & Incident Response
InterviewUp continuously monitors application performance, error rates, and system anomalies to identify potential security issues, service disruptions, or unauthorized access attempts.
In the event of a security incident that impacts personal data, InterviewUp maintains an incident response procedure to contain the issue, investigate the cause, and remediate affected systems.
- Audit Logging: Critical system events, authentication attempts, and administrative actions generate secure audit logs for anomaly analysis.
- Automated Backups: Database snapshots and configurations are replicated in accordance with Google Cloud disaster recovery baselines.
- Breach Notification Commitment: If an incident involving unauthorized access to your personal data is confirmed, we will notify affected users and relevant supervisory authorities in accordance with applicable legal timeframes.
Your Role in Account Security
Security is a shared responsibility. While InterviewUp provides comprehensive technical safeguards, your account remains safest when you take practical precautions to protect your credentials.
- Create a Strong, Unique Password: Use a complex password containing a combination of letters, numbers, and symbols that is not reused across other online accounts.
- Protect Credentials: Never share your login credentials, verification codes, or account details with anyone. InterviewUp staff will never ask for your password.
- Sign Out on Shared Devices: Always sign out of your account when practicing on shared computers in libraries, universities, or workplaces.
- Report Suspicious Activity: If you notice unrecognized activity in your account, change your password immediately and contact our security team.
Vulnerability Disclosure & Bug Reporting
We value the contributions of independent security researchers and the broader cybersecurity community. If you believe you have discovered a vulnerability or security flaw in InterviewUp, we encourage you to report it responsibly.
We ask that you give us a reasonable amount of time to investigate and resolve the issue before making any information public, and that you avoid disrupting service availability or accessing other users' private data during your research.
- Primary Reporting Channel: Submit detailed findings to our security team via email at info@interviewup.ai or through our contact portal at /contact.
- Provide Actionable Context: Include clear reproduction steps, affected endpoints, request payloads, and potential impact in your report.
- Safe Harbor: We will not pursue legal action against researchers who discover and report security vulnerabilities in good faith and in compliance with these guidelines.
Report a security concern
Submit technical findings or vulnerability reports to our security team.