Security
Security at Evalgist
Evalgist combines company-wide operational controls with product-specific safeguards. This page describes controls that are currently in use. It does not claim a certification or independent audit of Evalgist.
Shared account and operational controls
Clerk handles authentication and sessions for the shared Evalgist account. Clerk states in its Data Processing Addendum that personal data is strongly encrypted in transit and at rest.
Credentials are centrally managed and distributed only where a service requires them, and third-party dependencies pass a release-age quarantine and integrity checks before installation.
Product analytics use PostHog's EU endpoint and carry typed workflow metadata plus pseudonymous account identifiers (an account ID and a hashed email address) — never file bytes, extracted resume text, or candidate personal data. Error monitoring uses Sentry's EU endpoint, with Session Replay disabled.
Evalgist Shortlist controls
Shortlist product data is stored in a dedicated Supabase project in AWS eu-west-1 (Ireland). Supabase states that hosted data is encrypted at rest and in transit. User-scoped tables use Postgres Row Level Security policies tied to the authenticated account. Explicit administrative access is handled separately.
Storage residency and AI processing are separate. Analysis uses Anthropic models, and scanned PDFs may use Mistral OCR. Both are routed through OpenRouter with zero-data-retention routing enabled. AI processing is not described as EU-only.
Extracted resume text is deleted after analysis. Original uploaded files are retained for a 14-day recovery window and then deleted automatically. Evidence-backed results and evidence quotes remain until the customer deletes the relevant shortlist or account.
The current provider list, processing purposes, locations, and residency statements are published in the Subprocessors register. Product roles and retention are described in the Shortlist Privacy Policy and Data Processing Agreement. The contractual commitments behind them are set out in the Shortlist Terms of Service.
Personal-data breach notification
Evalgist notifies the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data. The initial notice describes the known nature and scope, contact point, likely consequences, and measures taken or proposed, to the extent available. Evalgist may provide information in phases without undue further delay.
The customer remains responsible for determining and making any notification to a supervisory authority or data subject. Evalgist provides reasonable assistance and does not publish a fixed acknowledgement, notification, or remediation deadline.
Report a vulnerability
Send suspected security vulnerabilities to security@evalgist.ai. Include the affected product or URL, reproduction steps, likely impact, and supporting evidence. Do not include candidate documents, credentials, or more personal data than the report requires.
We review reports privately and coordinate investigation and remediation with affected providers where necessary. We do not publish a response deadline, remediation deadline, safe-harbour programme, or bug-bounty commitment.