Last updated 2026-10-31
Each organization is kept apart
Every record belongs to an organization, and every query is scoped to the organization of the signed-in member. Candidates, bank items, sessions, scores, roles, teams and the audit log all carry the organization id, and links between them are checked across that boundary. A candidate link opens only the session it was minted for.
Signing in
- Interviewers sign in with a password, a one-time link sent to their email, or a Google, LinkedIn or GitHub account whose address the provider has verified. A new account exists only once its address is confirmed by email, and the password chosen at sign-up is kept only when the browser that chose it opens the link, so a confirmation sent to the wrong person activates nothing.
- Passwords are hashed with scrypt and never stored in clear. Ten wrong attempts lock an address for fifteen minutes. Links expire after fifteen minutes, work once, and are limited to five per address per fifteen minutes.
- Sessions are signed cookies, marked HttpOnly and SameSite, and sent only over HTTPS on a production address.
- Organizations admit colleagues by invitation, accepted by a click, or by a verified email domain proven with a DNS record that is checked again every week.
- Roles are owner, admin and interviewer. Owners decide who else owns the organization; the last owner cannot be removed.
Candidate links
A session link is a long random token with an expiry the interviewer sets. The exercise starts only when the candidate presses start, so a link preview or a mail scanner never starts the clock. Interviewers can renew, extend or cancel a link, and a cancelled link stops working at once.
What model providers see
- Generation sends the brief, the role, and for tailored exercises a short summary of the CV, never the CV itself.
- The in-exercise assistant sees the exercise material and the candidate's prompts for that session only.
- Scoring sends the candidate's comments, answers and prompts inside fenced markers with a per-request nonce, so text cannot pose as instructions. The scorer never sees the CV.
- Rankr uses Anthropic and OpenAI through their APIs, which under their API terms do not use customer content to train models. The provider for each role, generator, assistant and scorer, is configurable per deployment.
Data at rest and in transit
- Data lives in PostgreSQL at the hosting provider, encrypted at rest and backed up by the provider with point-in-time recovery.
- All traffic is over TLS with HSTS, content-type sniffing disabled and framing denied.
- Secrets live in the deployment's environment. Rotating the session secret signs everyone out; model keys rotate in place.
Visibility and deletion
- Membership, team, role, domain and erasure changes are written to an audit log that admins can read.
- Erasing a candidate removes the profile, CV, sessions, scores and tailored exercises. An admin can also export a candidate's data as a file, and set a retention period after which closed candidates are erased automatically.
Reporting a problem
If you believe you have found a vulnerability, write to rankr@localhost with the details. We confirm receipt within two business days and keep you informed until it is fixed. We ask that you do not access other organizations' data while testing.
On the way
Sign-in with Microsoft accounts and SAML for Business customers are planned. A SOC 2 audit is on the roadmap and has not started; we will publish the audit window on this page once it is scheduled, and we will not claim the report before it exists. Ask us for the current status before relying on any of these.