Skip to content
How it worksFor teamsSign in

Security

kojiex carries personal career information and treats it as confidential by design. This page is written for privacy officers, IT security teams, and procurement reviewers. It is a living document: each item is marked in place or underway.

The five things we will never do

These are architectural positions, not policies.

  1. No training on user content. Content goes to our AI provider under commercial API terms that exclude training. We never use it to improve the product. There is no consent setting for this, because the answer is always no.
  2. No biometrics. Voice is transcribed and discarded. No voiceprint, no speaker identification, no inference of emotion or anything else from how a person sounds.
  3. No scoring of people. kojiex never rates, ranks, or assesses a person. It drafts; the person decides. Nothing it produces is used by anyone else to make a decision about them.
  4. No sponsor visibility. We do not tell an organisation that buys seats anything about a person's use of kojiex: not what they said or made, not whether they started, not how far they got. Not on a screen, not in an export, not in an answer to a question, and not by implication from anything else it can see. The organisation is never even given an identifier for a person that means anything outside its own records. Enforced in the architecture and checked on every build, not promised in a policy.
  5. No demographic collection. No date of birth, gender, ethnicity, or staff identifiers. We collect what a CV needs and nothing else.

In place

  • Data at rest in Sydney (Supabase, ap-southeast-2), row-level security on every table, cross-user isolation covered by an automated test harness.
  • A least-privilege service tier: the application server holds the only elevated credential and scopes every read and write to the authenticated person.
  • Explicit, versioned consent for AI processing, separate from the terms of use, recorded and auditable, withdrawable at any time. Without it, no content leaves for processing.
  • The grounding rule as a control: every generated line must trace to what the person said. It ships locked and cannot be disabled by anyone.
  • Multi-factor authentication enforced for every administrator, ours and the customer organisation's.
  • Voice with provider logging disabled in both directions: dictation and spoken interviewer lines are processed without retention, and a visible recording indicator shows whenever the microphone is live.
  • The sponsor boundary, enforced four ways and checked on every push: career content is never queried by any organisation-facing code, so a content table added next year is forbidden the day it is created; the usage-bearing column is never returned; it may not even be used as a filter, because a filter's outcome can be observed indirectly; and the person's platform identifier is never fetched alongside the organisation's record of them. A person holding seats from two organisations appears to each under an unrelated identifier, and neither can correlate them.
  • A seat is a one-way grant. Once assigned it belongs to the person and cannot be reclaimed, reassigned, or refunded, and it is not returned to the pool if they leave. This is a privacy control: deciding a refund on an assigned seat would require telling the organisation whether that person had used it.
  • Finalising a run is terminal. No route exists, for the person or for us, to reopen a finalised interview.
  • Career content out of reach of the vendor: kojiex Limited's administrators can see account records (name, email, entitlement, activity) and cannot open a member's CV, letters, stories, coaching, or interview answers. Enforced in the database's row-level security, not by policy alone, and checked on every build. The one thing an administrator does read is the note a member writes when they request a session with a human coach, because it exists to brief that session; nothing else a person writes is reachable.
  • Notification as a rule, not a courtesy: what a person receives, or becomes, is something they are told about. Machine-enforced, with the permitted silences written down and justified.
  • Retention with teeth: organisation-held records of members are erased automatically (90 days by default, adjustable or switchable off), leaving only the organisation's own tally with nobody attached to it; deletion is a hard cascade that fails closed, proven by a test harness; exports return every original we hold.
  • Dormant-account erasure, built and scheduled. An account with no activity for about five years gets a warning email, a second a month later, and permanent deletion a month after that. Signing in resets the ladder, and the job cross-checks the activity trail before anything is destroyed, so someone who stayed signed in for years is not mistaken for dormant. kojiex went live in July 2026, so no account is yet old enough for the deletion step to have run.
  • Hashed IPs, never raw; metadata-only telemetry; an audit trail of account actions that never contains career content, which nothing in the product can edit and from which no entry can be selectively removed. It goes only when the account does. The one scheduled change is the un-linking of hashed IPs at 90 days, above.
  • Abuse and availability controls: every AI surface carries per-person and platform-wide rate and spend ceilings. A compromised account, a scripted client, or a stolen token cannot exhaust the service or run unbounded processing; ceiling trips alert a human.
  • Processor positions confirmed for both AI providers: the drafting provider's no-training commercial terms and 30-day safety-monitoring window, and the voice provider's retention position and account-level opt-out from model training. Confirmed directly, not cited from a marketing page.
  • Accessibility conformance to WCAG 2.2 AA: built to the standard from the start, a whole-app audit and fix pass completed, a conformance statement written (self-assessed, the standard form of accessibility declaration), and a screen-reader session (VoiceOver with Safari) run over the core journeys. A session with NVDA on Windows is still to come.
  • A privacy impact assessment support pack for reviewers: data flows, subprocessor register, retention statement, and this page's claims with their evidence, mapped to the NZ Information Privacy Principles. Available on request.
  • Encrypted in transit everywhere; secrets held server-side only; security.txt published.

Underway

  • Written confirmations from the remaining processors: the infrastructure provider's position on content passed to its rendering service, and the database provider's backup window.
  • Alert routing and an incident-response runbook, so a notifiable privacy breach can be reported to the Privacy Commissioner and the people affected as soon as practicable, the standard the Privacy Act 2020 sets.

Who processes data, and where

Data at rest stays in Sydney. Processing that leaves New Zealand: AI drafting (Anthropic, US; no-training commercial terms; 30-day safety-monitoring retention), voice synthesis and transcription (ElevenLabs, US; transcription not retained), email (Resend, US), and infrastructure and PDF rendering (Cloudflare). The full register is in the Privacy statement. kojiex Limited remains accountable for all of it under the NZ Privacy Act 2020.

Talk to us

Security questions, disclosure, or a copy of any artefact above as it lands: security@kojiex.com

Last updated 27 August 2026 · Statuses are reliable: if it says underway, it is not done yet.