How we protect candidate data, recruiter accounts, and the platform. Last updated August 2026.
Security controls
- Row-Level Security (RLS) on every database table. Each recruiter only sees their own searches, candidates and assessments.
- All backend operations execute through audited Edge Functions with JWT validation.
- Credit balances and subscription state can only be modified by server-side billing functions, never by the client.
- Leaked-password protection (HIBP) enabled on signup and password change.
- Secrets and API keys stored in a managed secret vault, never exposed to the browser.
Authentication
ViewSkill supports email/password and Google sign-in. Sessions use short-lived JWTs with automatic refresh. Admin actions require an explicit role grant stored in a dedicated user_roles table, never on the user profile, to prevent privilege escalation.
Data hosting and sub-processors
- Database and auth: Supabase (EU region).
- AI inference: third-party AI models via the Lovable AI Gateway.
- Source data: public GitHub profiles via the GitHub API.
- Contact enrichment: a verified third-party B2B contact provider, queried only when a recruiter explicitly clicks "Find contact", and only for professional contact data. Never automatic, never bulk.
- Payments: Stripe (PCI-DSS Level 1).
- Email: Resend.
- Notifications: Slack (optional, opt-in).
What we collect
Recruiters: email, name, hashed password (or Google ID), usage events, billing identifiers.
Candidates: publicly-available GitHub profile data (handle, bio, public repositories, contribution signals). We do not scrape private data. Candidates can request deletion at any time, see contact below.
Privacy, GDPR and the AI Act
ViewSkill processes personal data as a controller for recruiter accounts and as a processor for candidate data on behalf of recruiters. Lawful basis: legitimate interest (public professional data) and contract (recruiter accounts).
Data subjects can exercise access, rectification, deletion, portability and objection rights by writing to the address below. We respond within 30 days.
Retention: recruiter account data is kept for the life of the account plus 30 days; candidate search results are kept for 12 months unless the recruiter deletes them earlier; billing records are kept for 10 years as required by tax law.
ViewSkill is a decision-support tool. All scores, rankings and AI-generated evaluations are starting points for your recruiting process; final hiring decisions remain the responsibility of the human recruiter. See the Terms of Use.
Contact
Security or privacy questions, data-subject requests, vulnerability reports: [email protected]
We answer every message within one business day. Data-subject and security requests within 30 days, usually much faster.
This page describes controls implemented by ViewSkill. It is not an independent certification or third-party attestation.