Security and Workspaces

Veritik applies authentication, workspace authorization, server-side data access, and PostgreSQL security controls. Security is a shared responsibility between the platform and each organization using it.

Authentication

Veritik supports:

• Email and password authentication.
• Google SSO through Supabase Auth.

Google SSO requires a verified Google email. When it matches an existing account, Veritik links the Google identity rather than duplicating the account. Veritik then issues its standard secure application session.

Sessions

Application sessions use an HTTP-only cookie. Session tokens are stored as hashes in the database and expire after the configured session lifetime.

Users should log out when using shared devices and should never share cookies, tokens, passwords, OAuth codes, or screenshots containing secrets.

Workspace Isolation

Recruitment data is associated with a workspace, including jobs, candidates, status history, notes, and usage. Protected server operations verify both the authenticated user and their workspace membership.

A platform administrator may have separate administrative authorization. Administrative capability should not be confused with ordinary workspace membership.

Database Security

Public PostgreSQL tables use Row Level Security and restricted grants where configured. The Supabase service-role key can bypass RLS, so Veritik only uses it in server-side modules and route handlers.

Never expose SUPABASE_SERVICE_ROLE_KEY to browser code or prefix it with NEXT_PUBLIC_.

Candidate Data Responsibilities

Organizations using Veritik should:

• Have a lawful basis or proper authorization to process uploaded resumes.
• Upload only data required for recruitment.
• Limit access to authorized team members.
• Follow applicable privacy, retention, and deletion policies.
• Verify AI output before using it in a decision.

Service Providers

Veritik relies on authorized infrastructure, database, authentication, hosting, and AI providers to operate the service. Depending on the feature, this may include Supabase, Vercel, OpenAI, and Google. Candidate data is not sold, but it may be transmitted to these providers when necessary to deliver the requested functionality.

Review the public Privacy Policy, Terms of Service, and AI Disclaimer before using Veritik with production candidate data.

Reporting an Issue

Do not include passwords, API keys, service-role keys, OAuth client secrets, session cookies, or complete candidate records in a support message. Describe the issue and provide redacted evidence where possible.