Agent trust
The candidate agent is designed to run only for the authorized interview session, show visible session state, and report structured metadata rather than content.
Report integrity
Reports use timestamps, signal taxonomy, event ordering, and signatures so reviewers can see what changed and whether evidence was altered after collection.
Access control
Customer accounts should restrict report access by team, role, and hiring workflow, with administrative controls for retention and reviewer permissions.
What the applicant tracker holds, and how it is deleted.
The built-in ATS stores what your own careers form collects. That is candidate personal data, so it is worth being precise about where it sits and what removes it.
What is stored
A name, an email address, the answers your careers form asks, and any resume the candidate attached. Documents are stored as sent, and a searchable copy of their text is kept so your recruiters can find candidates by what they wrote. A few values are also read off each resume, such as years of experience and skills, and shown on the card as suggestions marked as ours rather than the candidate's. Nobody is scored, ranked or rejected automatically, and no uploaded document is used to train a model.
Where it sits
Records live in the application database; uploaded documents are held on storage partitioned per customer, separate from the signed interview reports. Uploads are type-checked by reading the file rather than trusting its name, and are served back only to authenticated users of the company that received them.
How it is removed
Resumes are deleted automatically once your retention window passes, six months after a hire or rejection by default, and an admin sets that window per company. Deleting a document removes the file and its searchable copy, not just the row. Deleting a candidate removes their documents with them, and deleting a company removes its records, its reports and its uploaded documents together. Removing a pipeline card leaves the candidate and their documents intact, which is deliberate: a closed application is not a deletion request.
Evidence flows from disclosed collection to controlled review.
The goal is not to watch everything. The goal is to preserve the right signals, keep them scoped, and make review decisions defensible.
Enterprise review topics
- Data retention and deletion policy.
- Candidate disclosure and consent language.
- Role-based reviewer access.
- ATS integration boundaries.
- Incident response and security contact process.
Available for security conversations
InterviewWatch can support security and procurement review with architecture context, data-flow explanation, policy guidance, and hosted-platform deployment options.