Security and responsible use
What we do, and what we refuse to do.
Stated plainly, including the parts that are not finished.
Pre-launch legal notice
The assessment workflow, client contract, candidate notice and consent language, FCRA and employment-law applicability, and jurisdictional requirements must be reviewed and approved by qualified counsel before production client or candidate data is accepted. This page and this application are not legal advice and must not be relied on as such.
What we do not claim
KEEN SIX does not claim SOC 2 certification, audit completion, HIPAA, GDPR or FCRA compliance, encryption certification, or malware scanning. Any future claim will require documented controls and independent verification.
Tenant isolation at the database
Every record is scoped to an organization and enforced with database row-level security, not client-side filtering. A client user cannot read another company's organizations, users, cases, candidates, files, messages, invoices or reports.
Private file storage
Uploaded materials live in a private, non-public store. Downloads are served through short-lived signed URLs to authorized users only. Uploads are validated for file type and size.
No malware scanning yet
Uploaded files are NOT scanned for malware today. Until that is configured and verified, do not upload files from untrusted sources.
Job-related information only
Intake collects role-related information. We do not solicit protected characteristics, and we ask clients not to supply them.
Prohibited inference
KEEN SIX does not perform facial-expression, emotion, voice-stress, biometric, personality, medical, disability, family, religious, political or deception inference. Ever.
No automated decision
No automated rejection, ranking or scoring of candidates is produced. Final reports are reviewed by a Senior Assessor before release.
Candidate correction and audit trail
Candidates may submit corrections. Corrections append and version the record; original evidence and original wording are never overwritten. Consequential actions are written to an audit log.
Secrets stay server-side
Service credentials are never exposed to the browser. Privileged operations run server-side against authorization checks.