›Data Security
Legal

Data Security

Last updated: 28 April 2026

We take the security of your data seriously. Here is a transparent breakdown of how Moxaim is architected to protect your information at every layer.

🔒
HTTPS Everywhere
All data transmitted between your browser and our servers, and between our servers and AI providers, is encrypted with TLS 1.2+.
🖥️
Your CV, On Your Account Only
The uploaded PDF or DOCX is deleted from our server seconds after parsing, and we never keep the file. The extracted text is saved to your own account, protected by row-level security, and you can delete it whenever you like. Live session state stays in your browser.
🔑
API Key Security
AI provider API keys are stored server-side in secured environment variables, never exposed to the browser or public network requests.
📦
Sandboxed Code Execution
Code submitted in the Coding Round is executed in JDoodle's isolated sandbox environment with strict resource and time limits.
🔒
Row-Level Secured Accounts
Authentication and your saved history are managed by Supabase with row-level security, so each account can only ever read its own data.
🧹
Minimal Data Retention
Live interview messages are processed in-memory per request and discarded immediately. What persists is deliberately small: your session summaries (role, scores) and the CV you chose to save. Both are clearable anytime.

Architecture Overview

Moxaim is designed with a privacy-first architecture:

  • Frontend (Browser): React application running in your browser. UI state and the assessment you are part-way through are held in browser memory or local storage. Your CV is not: it is read from your account when you sign in, so it is never left behind on a shared device. Session summaries sync to your account only when you are signed in.
  • Backend API: A thin Express.js server that acts as a secure proxy to AI providers. It holds API keys securely, forwards your requests to Anthropic (and OpenAI for voice), and returns responses. It does not log the content of your requests to a persistent store.
  • AI Providers (Anthropic & OpenAI): Your CV text and interview messages are processed by Anthropic's Claude models to generate questions and feedback; OpenAI is used only to convert questions to speech. Both operate under their own security frameworks (SOC 2 Type II) and do not train on data sent via their APIs.
  • Data & Auth (Supabase): Sign-in, your saved session history, and your stored CV are handled by Supabase with row-level security. Each account can access only its own rows.
  • Code Execution (JDoodle): Code submissions run in an isolated sandbox with CPU and time limits. No user code is persisted after execution.

What We Recommend to You

  • Do not include government ID numbers (Aadhaar, PAN), bank account details, or passwords in your CV upload or interview responses.
  • Use a device you trust when uploading CVs with sensitive employment history.
  • Clear your browser's local storage periodically if you share your device with others.
  • If you believe your data has been compromised, contact us immediately at the address below.

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue in Moxaim, please email us at security@moxaim.com with a description of the issue and steps to reproduce it. We commit to:

  • Acknowledging your report within 48 hours.
  • Investigating and responding with our assessment within 14 days.
  • Crediting responsible disclosures publicly (with your permission).

Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.

Compliance

Moxaim is designed to comply with:

  • Information Technology Act, 2000 (India)
  • IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
  • Digital Personal Data Protection Act, 2023 (DPDP Act)

As the platform grows, we will pursue additional certifications (ISO 27001, SOC 2) to provide independent validation of our security controls.