How Riwork handles interviews and data

• An AI interviewer asks the questions. It’s always introduced as an AI, never presented as a person, and says so if you ask.
• The assessment comes from the transcript. After the interview, AI scores each skill for the role from what you actually said (and, in a coding exercise, from the code you wrote), quoting your answers as evidence. Questions you didn’t answer score low, and strengths aren’t invented where the transcript shows none.
• People decide. The hiring company’s team reviews the assessment and the interview itself and makes every decision. Riwork never rejects or advances anyone on its own — there is no automated rejection, no automatic stage move and no automatic email to a candidate. A signed-in person does each of those.
• No analysis of faces, voices, emotions or personality. Speech is turned into text and only the words are assessed. Your camera is never analysed. See what Riwork does not analyse.
• You’re told up front. Before an interview starts, candidates see that it’s run by an AI and what the company will receive. If you need an adjustment — more time, typing instead of speaking — or would rather speak to a person, ask the company that invited you before you start.

The report is built from the transcript. Speech is turned into text, and the assessment is written from the words — what you said, and the code you wrote. Nothing else is read.

• No facial expression. Camera video is never analysed, and the video interviewer receives no camera feed at all.
• No emotion. Riwork does not detect, infer or score how you feel.
• No voice tone. Pitch, volume, accent and emphasis are not assessed. The only counts that touch on delivery are of words and of filler words, read off the transcript text, plus a per-minute rate where a spoken answer’s length is known. They appear in the practice report as delivery counts, never as a judgement, and the employer report does not carry them.
• No body language. There is no posture, gesture or movement analysis.
• No personality inference. Riwork does not build a profile of a candidate beyond what they said about the role.

The recording a company may switch on is a recording, kept as a file for the hiring team to watch. It is not fed to any analysis, and it is never sent to the model.

For an interview a company invites you to, Riwork keeps:

• Your name and email address — given by the company that invited you, or typed by you on its application form.
• The transcript — the interviewer’s questions and your answers (spoken answers as text), saved turn by turn as the interview happens.
• The assessment written from that transcript.
• Simple activity signals — how often and for how long you left the interview tab, and how often you pasted text and how much. Reviewers see them as context, never as a verdict, and they’re not scored.
• Your code, if the interview has a coding exercise — saved every few seconds as you write it (so reviewers can replay how you worked), with the results of your test runs and the code you finish with.
• A recording, only if the company turned recording on. It’s made in your browser — both voices, and your camera if you switch it on — and uploaded to private storage. You’re told before you start.

Nothing else. There are no advertising or tracking cookies, and nothing is bought from or matched against other sources. The only cookie is the sign-in cookie for employer accounts.

For employer accounts Riwork keeps each member’s name, email address and password (only as a hash), the workspace’s settings, and a log of actions in the workspace — such as who invited, moved or deleted a candidate.

Interview data is handled by these services, each only for the job described. Always on means the service is part of how Riwork works, for every workspace. If enabled means it is only there when the company or the operator turns it on — but for a customer who has turned it on, it is a sub-processor for that customer too, and it is listed here and in the DPA for them.

• Anthropic

  Always on

  Runs the interview conversation and writes the assessment.

  Receives: The role details, the conversation and your name, so the interviewer can greet you — and your code, if the interview has a coding exercise.

• Deepgram

  Always on

  Live speech-to-text, when you answer by voice.

  Receives: Your microphone audio, streamed straight from your browser. By default it's opted out of Deepgram's model-improvement programme.

• ElevenLabs

  Always on

  The interviewer's voice.

  Receives: Only the interviewer's words — never your audio.

• Tavus, with Daily

  Always on

  The optional live video interviewer.

  Receives: Only the interviewer's words. Your browser joins the video call receive-only, so your camera and microphone are never sent to it.

• Vercel

  Always on

  Hosts the app, and stores recordings as private files when a company turns recording on.

  Receives: Requests to the app (with routine logs, such as IP addresses, for security and reliability) and those recordings.

• Database provider (e.g. Neon)

  Always on

  Stores workspace data.

  Receives: Employer accounts, interviews, candidates, transcripts, reports, activity signals and code from coding exercises.

• Resend

  Always on

  Sends the emails a workspace needs — invitations, reminders, password resets and decision emails — where the deployment is configured to send email.

  Receives: The recipient's name and email address, and their invitation or account link.

• Stripe

  If enabled

  Billing, only if the company subscribes to a paid plan.

  Receives: The billing contact's name and email address, and payment details. Candidate interview data is not sent to Stripe.

• Google

  If enabled

  Sign-in for hiring-team members, only if the deployment configures Google sign-in.

  Receives: Your name and email address, and a one-time sign-in code. Google returns an identity token; Riwork reads the name and email from it.

• Microsoft

  If enabled

  Sign-in for hiring-team members, only if the deployment configures Microsoft sign-in.

  Receives: Your name and email address, and a one-time sign-in code. Microsoft returns an identity token; Riwork reads the name and email from it.

• Google Calendar

  If enabled

  Live follow-up scheduling, only if a reviewer connects their own Google Calendar.

  Receives: An event on the reviewer's own calendar: the candidate's name, the job title, a time, and a link to the candidate page that needs a sign-in. No attendees, transcript or recording. Ava stores only an encrypted refresh token.

• Microsoft Graph (Outlook Calendar)

  If enabled

  Live follow-up scheduling, only if a reviewer connects their own Outlook calendar.

  Receives: An event on the reviewer's own calendar: the candidate's name, the job title, a time, and a link to the candidate page that needs a sign-in. No attendees, transcript or recording. Ava stores only an encrypted refresh token.

• Greenhouse

  If enabled

  Applicant tracking, only if the company connects its Greenhouse account.

  Receives: Candidate names, email addresses and stage names pulled from Greenhouse, and a short note with the interview score and recommendation written back as a private note. The transcript and the recording are never sent.

• Lever

  If enabled

  Applicant tracking, only if the company connects its Lever account.

  Receives: Candidate names, email addresses and stage names pulled from Lever, and a short note with the interview score and recommendation written back as a private note. The transcript and the recording are never sent.

• Workable

  If enabled

  Applicant tracking, only if the company connects its Workable account.

  Receives: Candidate names, email addresses and stage names pulled from Workable, and a short note with the interview score and recommendation written back as a comment. The transcript and the recording are never sent.

• Slack

  If enabled

  Notifications, only if the company adds a Slack incoming-webhook endpoint.

  Receives: A short message: the candidate's name, the role, a score, a stage name and a link that needs a sign-in. No transcript, no recording.

• Sentry

  If enabled

  Error reports, only if the operator sets an error-reporting destination.

  Receives: Scrubbed error text: the route, the method, the error name and message, a stack and a request id. Emails, tokens, connection strings and query strings are removed before sending, and no request body or header is included.

• Plausible

  If enabled

  Cookie-less page analytics, only if the operator turns it on.

  Receives: Page paths and event names. No cookies, no personal data as event properties.

API keys stay on Riwork’ server. If the speech service is unavailable while you answer by voice, your browser’s built-in speech recognition may be used instead, and some browsers (Chrome, for example) process it on their maker’s servers. Each service handles data under its own terms.

The same list, in the same two categories, is in the DPA template (docs/legal/dpa-template.md, section 5) and the security questionnaire (docs/security-questionnaire.md, question 8). Each vendor’s location, contract and transfer mechanism are still to be completed by the owner: [sub-processor locations and contract references].

• Every workspace sets a retention period — 180 days unless the company changes it — and you’re shown it before you start. That many days after you finish, the interview, its transcript, report and recording are deleted automatically. If the company later lengthens its period, your interview still goes when you were told it would.
• A daily job does the deleting. Every day it removes the interviews, transcripts, reports and recordings that are past their retention period, along with expired sessions and team invitations. Recordings are removed from storage before the rows that point at them.
• Companies can delete a candidate at any time, which erases their interview, report and recording at once.
• You can get a copy of your data. The hiring team can download everything held about one candidate as a JSON file, and can export the whole workspace as JSON. If you want your data, ask the company that invited you — it controls your interview.
• The whole workspace can be erased, by its owner, in one step: the candidates, the interviews, the transcripts, the reports, the recordings and the members go together.
• Where the data sits — in the hosting provider’s and the database provider’s regions, which the operator chooses. [regions in use, and the transfer mechanism for any that are outside the customer’s market]

• Passwords are hashed with scrypt and a unique salt; they’re never stored in plain text.
• Sign-in sessions and personal links (interview, team invitation and email confirmation links) are random secrets stored only as SHA-256 hashes, so even a copy of the database wouldn’t contain one that works. A job’s application link is public by design: it only lets people apply.
• Strict workspace isolation — every request is limited to the signed-in member’s own workspace.
• Recordings are private files in Riwork’ own storage, never publicly reachable, and streamed only to signed-in members of the company’s workspace.
• HTTPS everywhere, with HSTS, and a strict Content Security Policy that limits which services a page can talk to. Interview links aren’t passed on to other sites and are kept out of search engines.
• Code runs in a sealed sandbox. Code from a coding exercise runs in your browser (and later in reviewers’) inside an isolated frame with no access to the page, your accounts, cookies or the network; only the test inputs go in and the results come out, so it can’t fake a pass. Tests the company keeps hidden never reach the candidate’s browser.
• Rate limits and same-site checks on the app’s API to stop abuse, and daily limits on the emails a workspace can send — only after one of its owners or admins has confirmed their own address.

Sign in with a free account before starting. The conversation is processed to run your interview and generate your report, but is not saved to your account unless you choose to save the result. Your camera and any recording stay on your device.

A free seeker account is required to start. We store your email and authentication identifier. Results are saved only when you choose to save them; transcripts remain optional. Shared results are transcript-free, expire after 14 days and can be revoked; the preview image shows the score and role, never your email. Export or delete everything from My practice at any time. Seeker accounts are separate from hiring-team accounts.

Article 4 of the EU AI Act has been in force since 2 February 2025. It asks providers and deployers to take measures to support the development of AI literacy among the people they involve. Whether that duty reaches your organisation, and what discharging it looks like, is your counsel’s call — Riwork’ job is to give you material to work with, not to tell you that you are done.

What Riwork provides to help a company meet it:

• An AI-literacy guide — what AI literacy means for interviewers and reviewers who use Riwork, and a short checklist a company can run with them. AI-literacy page
• An explainability statement a company’s counsel can be forwarded: what Riwork collects, what it does not analyse, how the assessment is written, which sub-processors are involved and where a human sits in the loop. Read the explainability statement
• The evidence for the statement itself — this page, the methodology, and the data-handling facts a company can check against the code.

Using AI in recruitment is regulated. The EU AI Act treats it as high-risk, and places such as New York City (Local Law 144, on automated employment decision tools), Colorado and Illinois have their own rules; requirements differ by country, state and city.

A company that uses Riwork stays responsible for how it uses it, including any notices, assessments or audits required where it hires. Riwork is designed to support that: candidates are told up front, people review every result, actions in a workspace are logged, and the company controls how long data is kept.

Where the notice and review content lives. The statutory notice text a company must show candidates, and the route by which a candidate can ask for a correction or a human review, are separate documents, so the legal text stays in one place:

• Illinois Subpart J notice content — what a company must tell a candidate before an AI-assisted hiring process, and the candidate’s right to request an alternative process. [link to the notice content]
• The Colorado, New York City Local Law 144 and GDPR Article 22 route to a review — how a candidate asks for their report to be corrected or for a person to look at it, and what happens next. How the contest route works

See also our Methodology (how Riwork interviews and scores), Privacy policy and Terms of service. This page describes how the software works. It isn’t legal advice, and it isn’t a certification.