Trust Center
How we protect your candidates' and employees' data
Goodfit is SOC 2 Type II compliant. We run AI interviews, practice calls, check-in calls and exit interviews for HR teams, so the data we handle is personal and sensitive. This page summarizes the controls that protect it. The full set of 28 documents, with evidence captured from our production systems, is shared with clients and prospects under NDA.
- Last updated
- 1 Oct 2026
- Owner
- Prasanth P, Accountable Executive
- Security contact
- support@goodfit.so
Open the full document set
28 controlled documents, live production evidence and the Q3 2026 review record.
No password yet? Request access
The documents are encrypted and open only with a valid password, which is checked in your browser. It is never sent to us.
Compliance
SOC 2 Type II compliant
Our controls are independently audited.
AI training
Never on your data
Neither Goodfit nor our AI providers train models on client data.
Decisions
Made by people
AI scores are advisory. Your reviewer has the final say.
Privacy law
DPDP Act 2023 (India)
Goodfit acts as Data Processor for your organisation.
Data location
Mumbai, India
Database, recordings and identity imagery.
Is Goodfit SOC 2 compliant?
Yes. Goodfit is SOC 2 Type II compliant, and our controls are independently audited. SGP-00 covers our compliance program.
Do you use our data to train AI?
No. Goodfit never uses client data to train or fine-tune any model, and every AI provider we use has confirmed in writing that our data is excluded from their model training. SGP-18 lists each provider.
Do you share our data with anyone?
No. Your data is never sold or shared with anyone. The service providers listed in SGP-18 process it only to run Goodfit for you.
Where is our data stored?
In Mumbai, India: the database, interview recordings, assessment media and identity imagery. AI model providers process session content to produce results and do not use it for training. Two kinds of derived data are held outside India, resume search vectors (no resume text) and application error reports. SGP-21 lists both.
Who makes hiring decisions?
Your team. AI scores are advisory. When a reviewer sets a final status (hired, rejected or shortlisted), that decision stands and the system cannot change it afterwards. Automatic status changes run only if your team sets up an automation rule, which is off by default and logged as a system action. SGP-11 shows the evidence.
How long do you keep our data?
Retention windows are enforced by scheduled deletion jobs, and identity imagery is deleted after 30 days. Interview recordings are kept for the period your organisation chooses. SGP-04 has the full schedule and deletion logs.
How do we get supporting documents for a security review?
Ask your Goodfit contact or write to support@goodfit.so. Supporting documents are shared under NDA.
How do we report a security issue?
Email support@goodfit.so with "Security" in the subject line. Include what you found and how to reproduce it.
Controls
What is in place today
Each control points to the document with the detail and evidence.
Governance
SOC 2 Type II compliantSGP-00
Our controls are independently audited.
Scheduled reviewsSGP-95
Reviews run on a published governance calendar. The Q3 2026 baseline review is on record.
Sub-processor registerSGP-18
Every sub-processor listed with its service, the data it touches and its security posture.
Controlled documentsSGP-08
Each document carries its created date, last update and approver.
Data protection
Encryption in transitSGP-10
Web apps and API use TLS 1.2 and 1.3. A weekly scan confirms older protocols are off on the candidate app.
Encryption at restSGP-95
Managed encryption at rest on the database and all storage, with AES-256 confirmed on every S3 bucket.
Automated deletionSGP-04
Scheduled jobs enforce retention windows. Identity imagery is deleted after 30 days.
Data stored in IndiaSGP-21
Database, recordings, assessment media and identity imagery are kept in Mumbai.
Access control
Role-based accessSGP-15
Owner, admin, recruiter and member roles. Every request is checked against its organisation.
Single sign-onSGP-14
Sign in with Google, Microsoft or LinkedIn, so those users are covered by your identity provider's multi-factor rules.
Least-privilege credentialsSGP-15
Separate service credentials per function. Identity imagery has its own isolated keys.
Staff access defined in codeSGP-15
Goodfit staff access lists live in code, and every change goes through a pull request.
AI governance
People make the decisionsSGP-11
AI scores are advisory. A reviewer's decision stands and the system cannot overwrite it.
No training, no sharingSGP-01
Client data is never used to train models, by Goodfit or our AI providers, and is never sold or shared.
Named modelsSGP-02
Every model is named explicitly in code, with no "latest" aliases, and reconciled against production each quarter.
Accuracy and biasSGP-05
A 16,899-evaluation accuracy audit and a bias baseline, with sample sizes.
Infrastructure
Private storageSGP-14
Recordings and identity imagery sit in private buckets, opened only through links that expire within 30 minutes.
Infrastructure as codeSGP-21
Google Cloud storage and the call stack are defined in version-controlled Terraform and Helm.
Reviewed changesSGP-13
Every change ships through a pull request reviewed by automated code reviewers before merge.
Monitoring and resilience
Error monitoringSGP-14
The candidate app, client dashboard and API report errors to a monitoring service that alerts the team.
Watched deletion jobsSGP-04
Deletion jobs log every run, and a missed run raises an alert.
Kill switchSGP-17
The automatic dialer for exit and check-in calls has a kill switch, changed by reviewed commit. It is engaged in production today.
Audit log retentionSGP-14
Google Cloud admin audit logs are kept for 400 days in a locked store.
Documents
The Security & Governance Pack
Every document shows when it was created, last updated and who approved it.
Overview and index
How the pack is organised and what is shared on request
Data Flow & Lineage
Roles/lawful basis, data sources, per-feature flows, cross-border touchpoints
Model & API Inventory
Every AI model in production, pinning discipline, change history, reconciliation
Consent & Notices
In-product notice wording (verbatim), consent records, withdrawal handling
Retention & Deletion
Enforced-in-code retention windows with production deletion logs
Accuracy & Bias Assessment
Judge-audit round (16,899 evaluations), human comparisons, bias baseline
Competency & Training
Roles, competency matrix, training curriculum (run under SOC 2 program)
Grievance & Incident Process
Classes, SLAs, escalation, closure records
Document Control & Records
Version control, approval records, retention schedule for records
AI Lifecycle & Stage Gates
Entry/exit criteria per stage with real production gate records
Testing Evidence
Automated security scans, executed suite results, backtesting, QA harness
Human Oversight & Overrides
Advisory-score design, code-enforced human supremacy, override evidence
Guardrails & Adversarial Testing
OWASP LLM Top 10 alignment, executed adversarial round
Change Control & Rollback
PR-only pipeline, drift prevention, rollback levers exercised in production
Security Architecture Review
Segmentation, auth, encryption, logging. Reviewed annually
Access Control & Recertification
Client role matrix, internal tiers, service credentials, recertification
Agent Permissions & Kill-Switches
Agent tool boundaries, kill-switch inventory, deterministic safety nets
Vendor & Sub-processor Management
Sub-processor register, due diligence, monitoring cadence
Data Residency & Cross-Border
Region-by-region hosting evidence, transfers, backups/DR
Information Security Policy
Commitments, roles, data classification, policy statements, exceptions
Incident Management Policy
Severity levels, response times, client and CERT-In notification, root-cause records
Business Continuity and Disaster Recovery Policy
Recovery objectives, regional outage procedure, restore testing
Vulnerability and Patch Management Policy
Scanning sources, remediation deadlines by severity, exceptions
Key and Secret Management Policy
Encryption keys, secret storage and access, rotation triggers
Personnel Security Policy
Background verification, confidentiality, training, offboarding
Governance Calendar
Every recurring obligation with owner and cadence
Periodic Review Record: Q3 2026
Dated review results, findings and actions for the controls above
Evidence Index
Where to find the proof behind each document, what is still to be added
Penetration test summary
Shared under NDA on request. Ask for it
Data Processing Agreement
Available on request. Ask for it
Updates
Changes to this Trust Center
Changes to this page and the documents behind it.
- Trust Center moved onto goodfit.so with a public overview, controls summary and document library.
- Q3 2026 periodic review published (SGP-95). Live production snapshots added. Every document checked against production and dated.
- First edition of the Security & Governance Pack.