Security at Mukhtabir

• Candidates — individuals who participate in AI-powered interviews and whose personal data, voice, and responses are processed by the platform.
• Organizations — HR teams, recruiters, and enterprise clients who use Mukhtabir to conduct assessments and manage hiring workflows.
• The platform itself — ensuring the integrity, availability, and confidentiality of all data and systems.

Architecture Principles

• Defense-in-depth: multiple independent security layers protect platform data and services.
• Network segmentation: platform services are isolated into separate network zones, limiting lateral movement in the event of a breach.
• Zero-trust principles: no component of the system automatically trusts another; all inter-service communication is authenticated and authorized.
• Principle of least privilege: services and processes are granted only the minimum permissions required to perform their function.
• Redundancy and resilience: the platform is designed for high availability with failover mechanisms to ensure continuity of service.
• Immutable infrastructure: deployments use versioned, tested images to minimize configuration drift and unauthorized changes.

Access Control Measures

• Role-Based Access Control (RBAC): Organizations can assign roles to their team members — such as administrator, recruiter, or reviewer — with each role controlling what data and features can be accessed.
• Principle of Least Privilege: Every user, service, and internal system process is granted the minimum level of access required to perform its designated function.
• Secure Authentication: User accounts are protected through secure credential management. Organizations may enforce multi-factor authentication (MFA) for their team members to add an additional verification layer.
• Session Management: User sessions are managed securely with automatic expiry and invalidation mechanisms to reduce risk from abandoned or stolen sessions.
• Access Logging: Access to sensitive data and administrative actions are logged for audit and review purposes.

Secure Development Practices

• Secure Coding Standards: Developers follow established secure coding guidelines to prevent common vulnerabilities such as injection attacks, cross-site scripting (XSS), and insecure data handling.
• Code Review: All code changes undergo review before deployment, with security considerations as part of the review process.
• Dependency Vulnerability Monitoring: Third-party libraries and dependencies are continuously monitored for known security vulnerabilities. Critical issues are remediated promptly.
• Security Testing: The platform undergoes regular security testing as part of the development and release process to identify and remediate potential issues before they reach production.
• Controlled Deployments: Code changes follow a structured release process with testing in isolated environments before promotion to production.

AI Security Measures

• Prevention of AI Misuse: The platform is designed to prevent the AI systems from being manipulated or abused — for example, through prompt injection attacks or attempts to extract internal system instructions.
• Data Isolation Between Organizations: AI processing for one organization's interviews is isolated from other organizations. Candidate data from one employer is never used to influence AI evaluations for another employer on the platform.
• AI Behavior Monitoring: AI-generated outputs — including questions, follow-up prompts, and evaluation scores — are subject to ongoing monitoring to detect anomalies, unexpected behavior, or outputs that fall outside expected parameters.
• Safeguards Against Abuse: Rate limiting, session controls, and behavioral detection mechanisms are in place to prevent abuse of AI features by malicious actors.
• Responsible Model Use: AI models used by Mukhtabir are selected and configured with safety and reliability as primary considerations. Model outputs are not used to make final employment decisions without human oversight.

• Data Minimization: We collect only the data necessary to deliver the platform's services. We do not collect personal data speculatively or for purposes beyond those disclosed.
• Purpose Limitation: Data collected during interview sessions — including recordings and transcripts — is used only for the purposes described in our Privacy Policy and agreed to by the organization and candidate.
• Logical Data Separation: Each organization's data is logically separated on the platform. One organization cannot access another organization's candidates, interviews, or settings.
• Data Retention Controls: Interview data is retained for defined periods consistent with our data retention policy. Organizations may request data deletion in accordance with applicable data protection rights.
• Third-Party Access Controls: Where third-party service providers process data on behalf of Mukhtabir, we ensure appropriate contractual safeguards are in place. Third parties do not have unrestricted access to candidate or organization data.

Our Incident Response Approach

• Detection: Security monitoring systems and internal reports are used to identify potential incidents as quickly as possible.
• Containment: Upon identification, we take immediate steps to contain the incident — isolating affected systems and preventing further unauthorized access or data exposure.
• Investigation: We investigate the root cause, scope, and impact of the incident using audit logs and forensic tools.
• Remediation: Affected systems are remediated and hardened to prevent recurrence. Vulnerabilities that enabled the incident are patched.
• Notification: Where a security incident involves personal data and meets applicable legal notification thresholds, we will notify affected organizations and, where required, relevant data protection authorities in accordance with applicable law.
• Post-Incident Review: Every significant security incident is followed by a formal review to identify lessons learned and improve our security posture.

Responsible Disclosure Guidelines

• Report the vulnerability to our security team as soon as possible after discovery.
• Provide sufficient detail to reproduce and understand the issue, including steps, affected URLs or endpoints, and potential impact.
• Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.
• Do not access, modify, or delete data belonging to other users or organizations.
• Do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and remediate.

Organization Responsibilities

• Account Security: Organizations are responsible for protecting their account credentials and ensuring that only authorized team members have access to the Mukhtabir dashboard and candidate data.
• Role Assignment: Organizations should assign appropriate roles to team members and promptly revoke access for individuals who no longer require it.
• Candidate Consent: Organizations must ensure that candidates are properly informed about the use of AI in the interview process and have provided appropriate consent in accordance with applicable law.
• Lawful Use: Organizations must use Mukhtabir only for lawful purposes and in accordance with our Terms of Service. The platform must not be used to conduct assessments that discriminate unlawfully or violate candidate rights.
• Breach Notification: Organizations must notify Mukhtabir promptly if they become aware of any unauthorized access to their Mukhtabir account or any suspected compromise of candidate data.
• API Integration Security: Organizations that integrate Mukhtabir via API are responsible for securing their API credentials and ensuring that their integration does not expose sensitive data to unauthorized parties.

• Regular Security Reviews: We conduct regular internal security reviews of our architecture, access controls, and operational procedures to identify areas for improvement.
• Security Awareness: Team members involved in platform development and operations receive ongoing security awareness guidance relevant to their roles.
• Timely Patching: Security patches for platform dependencies and infrastructure components are applied promptly following disclosure, prioritizing those with the highest risk.
• Evolving with the Platform: As Mukhtabir introduces new AI capabilities, integrations, and features, security review is conducted as part of the development process — not after the fact.
• Incorporating Feedback: Vulnerability reports, security incidents, and user feedback inform our security roadmap. We treat every finding as an opportunity to strengthen the platform.