Product security overview
Understand the access, isolation, link, storage, and activity safeguards visible in the ProBB AI product.
Organisation isolation and access
Authenticated records are scoped to the active customer organisation. Viewer, Member, and Admin roles control organisation access, and Viewers cannot change workspace records. Admin-only operations include workspace profile, team, invitation, role, usage, and activity management.
Users should confirm the active organisation before uploading, downloading, sharing, or deleting candidate information.
Files and storage access
Uploaded resumes and interview recordings are kept in object storage. Upload and download operations use short-lived signed URLs. A signed file URL should still be treated as confidential while it remains valid.
Original resume downloads and exported PDFs leave the controlled workspace. Customers are responsible for securing, retaining, and deleting those copies.
Public report links
Public reports use long unlisted bearer links and field-level visibility controls. They do not require recipient authentication and do not currently expire automatically. Anyone who possesses an active link can access its enabled content.
The report creator or an organisation Admin can change visibility, replace the link token, or revoke the link. Original resume files, interview audio, and debug data are never included in the public report.
Interview invitations
Interview links are checked against session status and expiration. Invitations normally expire after seven days and should be sent only to the intended candidate.
Password and session protections
Users can change their password from account settings and request password recovery from the sign-in flow. Do not share accounts or invitation links. Sign out on shared devices and report suspected unauthorised access through the customer's approved support channel.
Changing your password signs out your other sessions and disconnects the AI assistants you connected, so reconnect them afterwards. Resetting a forgotten password also revokes your API keys. Ending your other session from the active-session prompt signs out only that browser session; it does not disconnect AI assistants or revoke API keys. Removing someone from a workspace disconnects their AI assistants for that workspace.
Activity records
ProBB AI records selected organisation events for administrative review, including relevant membership, usage, report, interview, sharing, and settings activity. The activity view is operational history, not a guaranteed immutable or exhaustive compliance audit log.
Reporting a security concern
Use the security or support contact provided by your ProBB AI agreement. Do not include unnecessary candidate records, transcripts, passwords, access tokens, or active public links in an initial report.
API and receiver credentials
An API key grants its selected scopes within one workspace, never more than its creator's role allows. It stops working if the key expires, is revoked, or its owner leaves the workspace or changes role. An Admin can turn API access off for the whole workspace. Give each key only the scopes it needs, for example the Sync only preset for an ATS. Keep keys in server-side secret storage, rotate them on a schedule, and revoke unused ones. The API sends no CORS headers, so a key must never be in browser code.
Webhook signing secrets authenticate the events sent to your server. They do not authorize API calls, and ProBB AI never sends your API key. Verify the signature of the raw body, and check its timestamp, before you process an event. Rotating a secret keeps the old one valid for 24 hours so you can switch without losing events. Webhook addresses must be HTTPS on the public internet.
Interview links (invitationUrl) and public-report URLs give access to their specific page for anyone who holds them. Treat them as confidential. See API authentication and webhook verification.