BerriBot Trust Center
A candidate's face, voice and ID are the most sensitive data a company will ever hold about someone who does not work there yet. This page covers how we protect that data: the frameworks and certifications we hold ourselves to, the controls we run every day, and the documents your security team can request.
How we think about security
Secure by default.
Industry-standard encryption for data at rest and in transit, role-based access controls, and per-feature data minimisation — each product feature processes only the data its job requires, nothing more.
Your candidates' data stays yours.
Data residency stated in writing, India included. Zero-retention terms with our model providers. A retention schedule with published deletion timelines, and deletions that are logged and verified.
No black boxes in hiring decisions.
Every candidate is scored against the same written rubric with the transcript quoted under each score. No emotion, personality or mood inference from face or voice. Human review before any decision that goes against a candidate.
What we say is what we sign.
The commitments on this page match the ones in our DPA and security documentation. The paperwork behind every framework below is released to your security team on request, after review.
Compliance
The frameworks below cover information security and privacy law on three continents. No certificate or report is published here: the documentation behind each one is released to your security team on request, after review.
SOC 2 Type II
Trust Services Criteria covering security, availability and confidentiality. Reports are shared with your security team under NDA.
Request documents →
ISO 27001
Certified Information Security Management System, covering access, change, incident and vendor management across the platform.
Request documents →
GDPR
EU General Data Protection Regulation. Lawful bases documented per data type, explicit consent for biometrics, data subject rights honoured on request.
Request documents →
CCPA / CPRA
California privacy law. Disclosure, deletion and opt-out rights supported through the same request channel as GDPR.
Request documents →
India DPDP Act, 2023
In progressDigital Personal Data Protection Act. Compliance work is in progress: consent, purpose limitation and data principal rights. Ask for the current status.
Request status →Tell us which documents you need. We review every request and email them to you.
Documents
The paperwork behind our practices. Public policies are a click away; audit and compliance materials are released on request, after review, most under a mutual NDA.
Request documents
Compliance documents aren't published on this site. Tell us what your team needs: we review every request and email the documents to you, most under a mutual NDA.
Candidate data request instead? Write to support@berribot.com.
The controls we run
A summary of the technical and organisational controls in operation today, across security, privacy and AI fairness.
Access security
Data protection
AI fairness and explainability
Candidate rights
Direct answers, closed by default
Where does candidate data live?+
Data residency is stated in writing for every deployment, India included. Residency and the region each data type rests in are named in the DPA rather than left to inference.
How long do you keep candidate data?+
30 days after the recruitment or assessment activity completes, by default. A client can instruct retention of up to 120 days in writing for audit or compliance purposes. After deletion, backups and logs are purged within 90 days.
How is biometric data handled?+
Face, voice and ID data is processed with explicit consent, or under employment and social-protection law where that applies. Candidates are told before the interview that verification will run, and there is an adjustments route for those who need one.
Can a candidate have their data deleted?+
Yes. Verified deletion requests sent to support@berribot.com are processed within 30 days, except where a legal or contractual obligation requires continued retention — and every deletion is logged and verified.
Is our data used to train models?+
We hold zero-retention terms with our model providers, and each product feature processes only the data its specific job requires.
What certifications and frameworks do you work against?+
SOC 2 Type II and ISO 27001 for information security, and GDPR and CCPA/CPRA for privacy; India's DPDP Act compliance is in progress. No certificate or report is published on this site: request the ones you need with the form on this page, and we email them after review, most under a mutual NDA.
Can we review security documents before we buy?+
Yes. You can request the DPA template, the SOC 2 Type II report, the ISO 27001 certificate, GDPR, CCPA/CPRA and DPDP documentation, the security architecture pack, the sub-processor list and the bias audit summary through the request form in our Trust Center or by emailing support@berribot.com. Requests are reviewed by the BerriBot team, and most documents are shared under a mutual NDA.
Is BerriBot fair? How does it reduce bias?+
Every candidate is scored against one written rubric per role, so everyone is assessed on the same criteria. BerriBot does not infer emotion, personality or mood from a candidate's face or voice. Bias is addressed through re-weighting, adversarial debiasing and fairness-aware training, and a human reviews before any adverse decision. A bias audit summary is available on request.
Talk to our security team
Vendor reviews, DPA questions or a candidate data request — write to us and a human answers. For compliance documents, use the request form.