Trust

isovy supports documentation of human oversight. Here is how we handle the data that makes that possible.

Data location: EU (database, authentication, storage). The web application itself is served via a global content delivery network.
Encryption: All traffic is encrypted in transit (TLS). Data is encrypted at rest.
Organisation isolation: Each organisation's data is separated by row-level security in the database.
Personal data about candidates: None by design. Cases are pseudonymous codes only; raters are pseudonymised in reports by default.
Backups: Automated daily database backups.
Retention: Set per organisation. Case data defaults to 24 months; the human oversight log is kept for at least 6 months. Expired data is deleted automatically and the deletion is logged.
Access: Invitation only, with email sign-in. Two-factor authentication is required for administrators.
Analytics and cookies: Product analytics run without tracking cookies, so no cookie banner is needed.