> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exterview.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Architecture-level security in Exterview, including encryption in transit and at rest, access control, keeping each customer's data separate, and continuous auditability.

## Purpose

How Exterview protects your data and controls access. This page describes posture, not implementation detail.

## Security posture

<CardGroup cols={2}>
  <Card title="Access & authentication" icon="right-to-bracket">
    Single sign-on via your identity provider; system access via credentials scoped to your organization.
  </Card>

  <Card title="Role-based access control" icon="user-gear">
    Permissions scoped by role. Configure, run, and review are separate.
  </Card>

  <Card title="Encryption" icon="lock">
    Data encrypted in transit and at rest.
  </Card>

  <Card title="Environment separation" icon="layer-group">
    Sandbox and production are isolated from each other.
  </Card>

  <Card title="Data separation" icon="building-shield">
    Your data, configuration, and scoring are kept separate from other customers'.
  </Card>

  <Card title="Audit logging" icon="clipboard-list">
    Actions and results are logged for traceability.
  </Card>
</CardGroup>

## At a glance

| Area            | Approach                                                                |
| --------------- | ----------------------------------------------------------------------- |
| Identity        | SSO for users; credentials scoped to your organization for systems.     |
| Authorization   | Roles and permissions, least privilege.                                 |
| Data protection | Encryption in transit and at rest.                                      |
| Isolation       | Each customer's data is kept separate; separate sandbox and production. |
| Traceability    | Audit logging across actions and results.                               |

## Certifications

| Standard              | What it covers                                       | Status          |
| --------------------- | ---------------------------------------------------- | --------------- |
| ISO/IEC 27001         | Information security management system               | **In progress** |
| SOC 2 Type II         | Security, availability, and confidentiality controls | **In progress** |
| ISO/IEC 42001         | AI management system                                 | **In progress** |
| GDPR (EU)             | Personal data protection and candidate rights        | **Operational** |
| DPDP Act 2023 (India) | Digital personal data protection                     | **Operational** |

Full status, scope, and evidence access are on the [Compliance FAQs](/trust/compliance-faqs) page.

<Info>
  Detailed security documentation and current reports are available to customers
  and prospects under NDA. Contact your Exterview representative.
</Info>

## FAQs

<AccordionGroup>
  <Accordion title="Is our data isolated from other customers?">
    Yes. Your data, configuration, and scoring are kept separate from other customers'.
  </Accordion>

  <Accordion title="How is access controlled?">
    Through roles and permissions scoped to your organization, following least
    privilege.
  </Accordion>

  <Accordion title="Can we get your security documentation?">
    Yes, under NDA. Ask your Exterview representative for the current pack.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Auditability" icon="clipboard-list" href="/trust/auditability">
    How access and actions are traced over time.
  </Card>

  <Card title="Compliance FAQs" icon="circle-question" href="/trust/compliance-faqs">
    Certification status and procurement questions.
  </Card>
</CardGroup>