Security & AI governance
How Calaris Assess approaches security and AI in evaluation.
Certification
ISO/IEC 27001:2022 certified
The international standard for information security management systems (ISMS). We're assessed by our certification body, run internal audits, and keep reviewing our setup.
- Standard
- ISO/IEC 27001:2022
- Registration No.
- GIJP-2161-IC
- Certification body
- GCERTI Co., Ltd. (IAS accreditation MSCB-113)
- Scope
- Headquarters
Security and AI governance at a glance
Certification and third-party testing
- ISO/IEC 27001:2022 (ISMS) certified
- Ongoing penetration testing by an external security firm
- Covered by cyber insurance
AI governance
- Human-in-the-Loop: your team always makes the pass/fail decision
- Only the transcript of what candidates say is evaluated, not video, audio, or personal attributes
- Candidate data is not used to train AI
- Proprietary technology to reduce variation in AI scoring
Data protection
- Encrypted with AES-256 at rest and TLS 1.2 or higher in transit
- SAML SSO supported, with an option to block non-SSO sign-in
- Actions such as views, exports, and permission changes are logged
Materials for your internal approval
Under an NDA, we provide materials for your internal review, such as a copy of our ISO/IEC 27001 certificate and an overview of our third-party penetration testing. If you are moving toward adoption, we also complete your security questionnaire.
Questions and answers
01 · CERTIFICATION & GOVERNANCE
Certification and governance
Yes: ISO/IEC 27001:2022, the international standard for information security management systems.
Registration number: GIJP-2161-IC.
Yes: ISO/IEC 27001 internal audits and assessments by our certification body.
We also run internal audits and management reviews of personal information handling.
Yes. An external security firm runs ongoing penetration tests.
We address findings based on severity.
We have information security and privacy policies, a personal information protection manager, and an audit lead.
We review policies at least once a year, and internal rules govern each stage of personal data handling: collection, use, storage, sharing, and deletion. Our privacy policy is published on our website.
See our privacy policyAll employees sign confidentiality agreements and take information security and privacy training when they join and at least once a year.
Our work rules also set confidentiality and data protection duties, with discipline for violations.
Yes. Under an NDA, we provide materials for your internal review. If you are moving toward adoption, we also complete your security questionnaire.
These include a copy of our ISO/IEC 27001 certificate and an overview of our third-party penetration testing. Contact us via the inquiry form, and we'll explain how to get the materials and send us your questionnaire.
Contact us02 · DATA PROTECTION
Data storage and protection
Data such as recordings and evaluation results is stored in Japan (Tokyo region).
We use cloud providers' data centers, not our own servers. Contact us for details such as where data is processed.
Contact usYes: TLS 1.2 or higher in transit, and AES-256 at rest.
Stored data is encrypted with keys we manage and rotate regularly. HTTPS is enforced on all connections to our websites.
Candidate data is separated by company, and you can use pseudonymized IDs instead of candidates' names.
We don't pass candidates' names or email addresses to the evaluation AI. We instruct the AI to keep names, including third parties', out of candidate feedback, which you can review and edit before it's sent.
The retention period is set in your contract.
We also accept deletion requests from candidates and companies. Candidates can ask the company they took the session for or contact us.
Contact us03 · ACCESS CONTROL
Access control
Sign in with email and password, or SAML single sign-on (SSO). You set what each team member can do.
SSO is set up after your domain ownership is verified, and you can enforce SSO-only sign-in. Only owners can invite members, change roles, and configure SSO. For each hiring process, you can grant permissions such as registering candidates, reviewing evaluations, or viewing evaluations only.
Passwords must be at least 8 characters and include uppercase and lowercase letters, numbers, and symbols.
After repeated failed sign-ins, the account locks temporarily and its active sessions end. Owners can unlock accounts in the admin console. Sessions expire after 8 hours. With SSO, the multi-factor authentication (MFA) set in your identity provider (IdP) applies as is. With the SSO-only setting added, every admin console sign-in requires your MFA.
Yes, including sign-ins, data exports, views of evaluations and recordings, and permission changes.
Logs are centrally managed and checked for signs of unauthorized viewing or data exfiltration. Contact us to review them.
04 · SESSION INTEGRITY & CANDIDATES
Session integrity and candidates
Each candidate gets their own session link, and an emailed verification code confirms identity when they book and join.
Codes expire after a short time. Repeated wrong entries lock the link temporarily. A session runs on one device only; opening it on another requires re-verifying with a code.
To check session integrity, we record camera video during the session. On the Standard Plan and above, we also record on-screen activity.
On the Standard Plan and above, recorded actions include switching tabs, exiting full screen, copy or print attempts, and connecting an external display. Depending on the plan and hiring process, a smartphone may also serve as a second camera showing the candidate's hands and surroundings. These records are used only to flag sessions for review, not for evaluation (scores).
They aren't failed automatically. We flag them for review, and you decide how to handle them.
The AI flags concerns from the video and activity records so your team can check the records themselves.
The terms of use appear before booking, and candidates agree after reviewing the full text.
Key points include: we handle data on behalf of the hiring company; video and audio are recorded; the AI's results are for reference and the company makes the hiring decision; and generative AI or help from others is not allowed during the session. We record the time of consent and the version of the terms.
Only after you review and approve it.
Candidates can view it for about one month after it's sent, using a verification code emailed to them.
05 · AI GOVERNANCE
AI use and transparency
General-purpose large language models from external AI services, which we don't train further ourselves.
Contact us for details such as which AI services we use and where processing takes place.
Contact usNo. Candidate data is not used to train AI models.
Our contracts and settings with the external AI services we use also keep data out of training.
Only the transcript of what the candidate says in the simulation.
Video and audio are used only to record the session and check its integrity, not for evaluation, emotion inference, or identifying individuals (biometrics). Attributes such as age, gender, and nationality, and documents such as résumés, aren't used either.
We have mechanisms to reduce scoring variation.
Scoring follows written criteria for each evaluation dimension.
Yes. Each dimension's score comes with an explanation of its evidence.
To verify and explain a score, recruiters can trace it to its evidence and the session record.
No. Your recruiters always make the pass/fail decision (Human-in-the-Loop).
The AI only compiles scores and evidence against the evaluation criteria and never makes a pass/fail decision on its own.
We assume bias is hard to eliminate entirely, so we keep detecting and reducing it.
Evaluation uses only the transcript of the simulation, and criteria are continually reviewed against actual session records. Our approach to bias draws on Japanese government guidance such as the AI Guidelines for Business (Ministry of Internal Affairs and Communications; Ministry of Economy, Trade and Industry).
By design, what candidates say is treated as material to evaluate, not as instructions to the AI.
We define how statements are passed to the AI and what result formats it can return, so statements aren't treated as instructions.