Are interview audio and transcripts sent outside Japan?

Yes. Speech recognition, response generation, speech synthesis and report writing use OpenAI's API, and the processing runs outside Japan. Under the APPI this is a provision to a third party in a foreign country, so the processors are named on the consent screen before the interview, and the consent given is stored as the version the candidate saw.

How long is data retained?

There is no fixed retention period. Data is deleted when you ask. No scheduled expiry is implemented, and we do not describe a mechanism we have not built as a policy. A retention period can be set by contract.

Security and privacy

What we hold, and where it sits

None of the following is a configurable option; each is a design decision. It is written at the level of detail your IT and legal teams can check as it stands.

Storage and encryption

Where the interview audio lives

Recordings stay on servers we operate: No external object storage. One more processor is one more company on the consent screen, and one more cross-border transfer an evaluation report does not need.
Each recording is encrypted with its own key: AES-256-GCM per recording. The data key is itself encrypted with a master key and stored apart from the audio, on the interview session's database row. The audio file, the wrapped key and the master key live in three different places.
Backups carry ciphertext only: The master key needed to decrypt is not in a backup. If a backup location were ever exposed, what it holds cannot be decrypted.
Interview links are not stored in the clear: Only a hash is kept. A leaked database cannot yield working interview links. The trade-off is that a link already sent cannot be read back on screen later.

Processors

Interview processing runs outside Japan

Speech recognition, question generation, speech synthesis and report writing use OpenAI's API. The processing runs outside Japan, which under the APPI is a provision of personal data to a third party in a foreign country.

So the processors are named on the consent screen before the interview begins, and the interview runs only on the candidate's own consent. The consent wording and the processor list are stored as the version the candidate saw. Adding a processor later never rewrites what somebody consented to earlier.

In-region processing was considered and has not been adopted. We would rather say so than describe something we do not do.

Retention and deletion

No scheduled expiry

Interview data is deleted when you ask. A mechanism that expires data after a set period is not implemented, and we do not describe a mechanism we have not built as a policy — so this page says exactly that.

Deletion covers the recording, the transcript and the report, and the deletion itself is written to the audit log. Only an account holder with the owner role can run it, and the screen shows what will be destroyed and how much before it does. A retention period can be set by contract.

Audit log

A record that cannot be rewritten

Each interview's record is an append-only log, hash-chained row to row. Alter a single row and every row after it fails verification, so tampering is detectable. What it records:

Consent wording version and processor list
What the candidate actually read
Rubric version, prompt-pack hash, model version
What the assessment was made against, and with what
Scores and rationales
The model's numbers and, where a person overrode one, both
Questions discarded before being spoken
The discard itself is the record
Who exported what
Taking data out is an action in the log
Who deleted what
Deleting does not delete the fact of deletion

The question screen under the Employment Security Act is described on its own page.

Certifications

We list none we do not hold

ISO/IEC 27001, SOC 2, Privacy Mark and other third-party certifications are not held at present. Plans are discussed in conversation. Security questionnaires are answered individually — send yours to hello@hitoshiru.com.