Trust Centre

What this page is

Every control oomou operates, listed with an honest status: built by us, inherited from AWS, or not yet done. A trust page that only lists wins is marketing; the outstanding items are on it deliberately.

Data and privacy

Identifying details are removed before AI scoring: names, employers, schools, locations, ages and demographic self-disclosures are replaced with neutral tags before any scoring model reads your transcript.

Voice audio is not retained — the conversation is transcribed and the recording is discarded. Credentials and personal data are excluded from logs. Consent is recorded with a timestamp. Erasure is self-service under GDPR Article 17, from your profile, with no support request needed.

Data is encrypted in transit and at rest and stored in the EU. We publish our subprocessor list and a documented retention schedule.

Application security

Passwordless authentication by emailed one-time code; signed, HttpOnly session cookies with server-side revocation; a centralised authorisation gate; cross-site request forgery protection; brute-force resistance on sign-in; abuse and cost rate limiting; security response headers; hardened input handling; and no cardholder data in scope, because payments are handled by Stripe.

AI safeguards

Blind assessment: demographic signal is removed before scoring and the scorer is instructed to give it zero weight if any survives. Prompt-injection isolation: everything a candidate says is fenced as evidence, never as instructions. Scoring is decomposed into rated facets and traceable to quotes. Failed scoring is reported as a failure rather than filled in with an invented profile. Stated limitations travel with every result. No model training on candidate content.

Not yet done, and we say so

We have not completed an independent penetration test, ISO/IEC 27001 or ISO/IEC 42001 certification, a formal production asset inventory, a data classification policy, or a data protection impact assessment.

Compliance posture: GDPR and UK GDPR — operating to it. ISO/IEC 27001 — aligned, not audited. ISO/IEC 42001 for AI management — partially aligned, not certified. SOC 2 — under assessment.