Skip to content
Sign in
Trust

Practical security. Legible AI.

Hiring data is sensitive and AI in hiring is scrutinized. Both deserve straight answers.

Book a 15-minute callPrivacy policy
Server-side sessions

HttpOnly cookies backed by Redis; no browser-stored API tokens.

Read-only Lever sync

OpenSeat mirrors Lever data for review without writing stages or tags back.

Retention controls

Deletion and retention requests are handled through customer workflows and policy review.

Compliance path

Controls are designed to support formal compliance work as the product matures.

Authentication

No passwords stored by OpenSeat.

  • Authentication delegated to Auth0 (OIDC/OAuth).
  • Sessions stored server-side and set as HttpOnly cookies.
  • Role-based access enforced server-side with organization scoping.

Browser protections

Reduce common web risk by default.

  • Content Security Policy (CSP) with per-request nonces.
  • CSRF protection on write operations.
  • Strict security headers served through the edge proxy.

Architecture

Sensitive work stays behind the BFF.

  • Next.js UI is served behind Caddy.
  • FastAPI handles auth, data access, sync, and AI calls.
  • Background workers process sync, parsing, scoring, and analysis jobs.

Data handling

Candidate data is treated as sensitive by default.

  • Lever data is mirrored into Postgres for fast review workflows.
  • Job-relevant text is sent to AI providers only when a workflow requires it.
  • OpenAI API usage is configured so submitted data is not used to train shared models.
Legible AI

How we use AI — and how we don't.

AI in hiring earns its scrutiny. Here is exactly what OpenSeat's model does, where it defers to people, and the guardrails that keep its recommendations explainable.

No auto-advance, no auto-reject

OpenSeat never advances or rejects a candidate on its own. It suggests an order and shows its reasoning; a person makes every hiring decision.

Uncertainty routes to a human

When the evidence is thin, a candidate goes to a needs-review lane instead of getting a fake-confident number. The model says "I'm not sure" rather than guessing.

Every score decomposes into evidence

A score is never a black box. It opens into requirement-level findings — met, likely, missing, contradicted — each pointing back to the source material.

A per-job AI off-switch

AI screening can be turned off for any individual job. When it's off, OpenSeat stays a review and record-keeping workspace with no automated scoring.

Score history is retained

When you move a requirement and candidates re-rank, the prior scores stay on the record — so a change is always explainable after the fact.

Humans make every call

OpenSeat makes sure nothing gets skipped and hands your team a defensible shortlist. Your team decides who advances and who passes.

A clear record of every decision

Review records are designed to be clear, categorical, and easy to trace back.

OpenSeat keeps ATS stage context, scorecard requests and submissions, AI rationale, reviewer notes, workflow states, and candidate activity in one candidate timeline.

This is a recruiter-facing decision history today. Formal compliance-grade audit exports and immutable event guarantees are future hardening work.

Subprocessors

Vendors used to deliver the service.

  • Auth0 - authentication and identity services.
  • Cloudflare - CDN, DNS, and security services.
  • Hostinger - infrastructure hosting for the core application.
  • OpenAI - AI services for candidate analysis features.
  • GitHub / GHCR - CI/CD and container image hosting.
  • Lever - ATS integration when enabled.

The authoritative list and details live in Privacy Policy.

Questions about security or how we use AI?

We can walk through architecture, subprocessors, retention expectations, the AI guardrails, and the rollout plan for your team.

Book a 15-minute callPrivacy policy