Last updated 18 September 2026
Security overview
Cadra is a work-sample assessment platform. This page states how we host and protect candidate and employer data. It is not a certificate, a pentest report, or a claim that we are SOC 2 or ISO 27001 certified.
Environments
Development and production only.
Hosting and encryption
Application compute runs in Google Cloud asia-south1 (Mumbai).
Candidate and employer personal data is stored in Supabase ap-northeast-2 (Seoul). A move to an India region is planned.
All public endpoints require TLS 1.2 or higher, with a restricted cipher suite.
Data is encrypted at rest by our infrastructure providers using AES-256.
Security and processing logs are retained for one year in an India-resident log store (Google Cloud asia-south1).
Access and secrets
Product data requires a signed-in account. Organisations are isolated at the database: one organisation's admins and candidates cannot read or write another's.
Application secrets are held in Google Secret Manager and injected at deploy time; none are stored in source control.
Our CI/CD pipeline authenticates to Google Cloud using keyless Workload Identity Federation — no long-lived cloud credentials are stored.
Multi-factor authentication is enforced on every administrative console we use.
Application controls
Our web application enforces HSTS, a restrictive Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict referrer policy.
Changes reach our release branches only through a pull request. Each one is gated by automated SAST (Semgrep, including custom rules for authorization and PII data-flow) and secret scanning (gitleaks); the branch rules are enforced with no bypass accounts, so a direct push cannot skip them.
Models
We use OpenRouter for model access. OpenRouter does not retain prompt or completion content by default and does not train on it. Individual upstream model providers apply their own retention policies. Cadra's own proxy does process prompt content — for token accounting, budget enforcement, and assessment integrity — and assessment transcripts are stored with your assessment record.
Integrity
We record provenance of the work produced in the assessment (authorship fingerprints, conversation and repository signals). We do not use webcam, keystroke dynamics, or screen recording. Scores describe a coding work sample. Cadra does not automatically reject a candidate on an integrity flag. What we collect is itemised on the privacy notice.
Reviews and certificates
A third-party penetration test is planned.
We are not currently ISO 27001 or SOC 2 certified. ISO 27001 is planned, triggered by customer demand. When reports or certificates exist, they come through our compliance partner and are not published on this page.