Security
Security and control for every interview
Protect candidate and interview data with role-based access, consent records, audit history, privacy workflows, and human review for AI‑assisted output.
Security controls
Workspace controls at a glance.
Controls
Review the controls that protect your workspace
See how Itya manages access, administrative activity, privacy requests, AI‑assisted output, and connected systems.
Roles and permissions
Owner, admin and member roles, enforced per permission, decide who can see and change what.
Sign-in and sessions
Two-factor authentication, session review, and sign-out of active sessions per user.
Audit history
Interview, scorecard, billing, security and administrative actions are recorded with actor context.
Privacy requests
Candidates request an export or deletion through a public, verified workflow. Consent records, legal holds and deletion timelines stay visible to administrators.
Human review of AI
AI‑assisted debriefs keep their source citations and a review state, so reviewers verify them against the transcript before they are shared.
Integration health
Scheduling and recruiting connections each show their connection and health state.
Security practices
Practical safeguards for interview data
Trovakap Private Limited operates Itya and is responsible for these safeguards. For more detail on how candidate and workspace data is handled, write to security@itya.ai.
Encryption in transit, and at the storage layer
Traffic is served over TLS 1.2/1.3 with HSTS. The database volume and the object store are encrypted by the hosting platform.
Application-level encryption for credentials
Integration OAuth tokens, ATS and webhook signing secrets, Slack tokens and two‑factor secrets are also sealed with AES‑256‑GCM under versioned keys.
Candidate data at rest
Candidate records, résumés, transcripts, scorecards and audit payloads rely on the encrypted storage layer; they are not column‑encrypted unless field‑level encryption is turned on.
Vulnerability disclosure
Report a vulnerability under the disclosure policy. Reports are acknowledged in 3 business days and triaged in 10.
Bring your security team into the evaluation
Start a 14-day trial to review access controls, privacy workflows and AI review in your own workspace, or talk to sales about a security review.