Access follows responsibility
Roles, organization and location scope, and journey permissions determine which applicants a staff member can view and which actions they can take. Protected actions are checked on the server.
TAPPEDIQ Trust Center
Confidence starts with clear answers.
Understand how applicant information is handled, how access is controlled, and where people remain in charge of hiring decisions.
Reviewed October 16, 2026 · Harnly Interactive Technologies LLC
Security
Practical controls around your hiring process.
An additional sign-in check
Email two-step verification can be required for an account. Codes expire, can be used once, and have resend and failed-attempt limits. It is not enabled for every account by default.
Protected applicant documents
Applicant documents use private storage. Downloads require authorization and an eligible recorded malware-scan status. Public marketing images are separate from applicant document storage.
Traceable hiring activity
Workflow decisions and supported amendments retain historical evidence. Access to activity and audit information follows the user’s permissions; this is not a claim that every action is logged.
Secure browser connections
The published application uses HTTPS. Infrastructure-provider security documentation describes their own services and scope; it is separate from an independent assessment of TAPPEDIQ.
Human hiring decisions
Authorized people submit evaluations and final hiring decisions. AI supports review and preparation; it does not replace the employer’s judgment.
These descriptions explain application controls. They are not an independent security audit, certification, uptime guarantee or promise that every risk is eliminated.
Your applicant information has a purpose.
The employer controls the hiring process
Customers determine what applicant information they collect, who may access it and how it supports their hiring process. TAPPEDIQ processes that information to provide the service. Our Privacy Policy states that we do not sell applicant data.
Retention and requests
Retention, exports and deletion depend on available product controls, authorized requests and applicable obligations. Backup and audit copies may follow separate retention periods; deletion is not described as instantaneous erasure from every system.
AI transparency
Assistance for people making decisions.
When an authorized user uses an eligible AI feature, TAPPEDIQ can generate follow-up interview questions from recorded interview evidence or summarize an applicant’s recorded hiring evidence. AI availability depends on the organization’s entitlement and the feature’s permissions and prerequisites.
What can be sent
Adaptive questions use position context, prior guide questions, interview answers, ratings, recommendations and notes. Applicant summaries can include the applicant’s name, position, location, journey status, interview and Shadow Day evidence, reference responses, submitted assessment answers, review outcomes and document filenames or types. Free-text entries may contain personal information.
Where it goes and what comes back
These features currently use Google Gemini 2.5 Flash through Lovable’s AI gateway. Prompts and generated responses are processed by those services. The reviewed summary path lists document metadata rather than reading document contents; malware scanning is a separate process.
Human review remains required. Outputs can be incomplete or incorrect. Review the underlying evidence and use job-related criteria. TAPPEDIQ does not use these AI outputs to automatically submit a final hiring or rejection decision.
Training and retention. Provider terms, account settings and the service used determine handling of AI requests. We have not verified a universal no-training or zero-retention commitment across every processing layer and do not make that promise here. Ask us to confirm your requirements before using AI with restricted information. Database hosting location does not establish AI inference location.
Services that help deliver TAPPEDIQ.
This map describes the principal application service paths reviewed for this release. Lovable Cloud uses Supabase-based infrastructure; this does not mean a separate customer-managed Supabase account. Providers can use their own subprocessors. Their documents describe their services, not a certification of TAPPEDIQ.
Lovable Cloud
- Purpose
- Application hosting, database, authentication, private file storage, AI gateway and connected-service routing.
- Information involved
- Account and organization information, applicant records and documents, authentication data, technical usage information, and AI requests when used.
- Location and scope
- Database location verified October 16, 2026: US East (Ohio). File, backup and downstream processing locations must be considered separately. Contact us to confirm residency requirements.
Resend through the linked email connection
- Purpose
- Transactional messages, including hiring communications, verification codes and password-reset emails.
- Information involved
- Recipient addresses, message content, necessary applicant or appointment context, and secure sign-in or recovery content when requested.
- Location and scope
- Email processing and recipient mail systems may operate in different regions.
Stripe
- Purpose
- Hosted checkout, subscription billing and payment processing.
- Information involved
- Billing contact, organization, subscription and payment information. Payment card entry is handled by Stripe; TAPPEDIQ uses billing references and subscription records.
- Location and scope
- Payment processing locations are governed by Stripe’s applicable terms.
DigitalOcean
- Purpose
- Hosting the separate malware-scanning service and independent encrypted file backups.
- Information involved
- Document bytes for transient malware scanning; separately, encrypted backup copies of uploaded documents, organization logos and document metadata. Backup retention is separate from the scanner’s transient processing.
- Location and scope
- United States scanner infrastructure and private backup storage in New York (NYC3).
Google Gemini through Lovable AI
- Purpose
- Adaptive interview questions and applicant evidence summaries when AI features are used.
- Information involved
- Selected hiring evidence described in the AI disclosure. Requests pass through Lovable’s AI gateway.
- Location and scope
- AI inference location can differ from database hosting. No single-country AI-processing commitment is published here.
Development uses Lovable and GitHub for application code and change history. Support correspondence is handled through our Google Workspace email. These are separate from routine applicant-record storage; avoid sending applicant documents or credentials in support email. Contact us for a review of the applicable vendor chain and agreements.
Backup and recovery: understand the scope.
Database snapshots
Lovable documents daily database backups retained for roughly 14 days. They cover database schema and records. Restoring a snapshot rolls back the whole database, including changes made after that snapshot; it is not a single-applicant undo or arbitrary point-in-time recovery.
Our October 16, 2026 review found 14 dated snapshots in the project’s backup inventory. Inventory review confirms available snapshots; it is not a completed recovery exercise.
Uploaded files are separate
Storage files are excluded from database snapshots. TAPPEDIQ separately schedules hourly encrypted backups of uploaded documents, organization logos and document metadata to private DigitalOcean storage in New York, United States.
On October 16, 2026, isolated recovery tests verified matching file bytes and metadata, including a restore of the first file backup into a disposable container. Live applicant records were unchanged. A combined database-and-file recovery exercise remains unverified; returning recovered documents to use requires review and current malware scanning.
No contractual recovery-time or recovery-point guarantee is stated on this page. Ask support about recovery requirements before relying on TAPPEDIQ as the only copy of important documents.
Provider backup documentation (opens in a new tab)Questions customers ask.
Is TAPPEDIQ independently SOC 2 audited or ISO 27001 certified?
We are not presenting TAPPEDIQ as independently SOC 2 audited or ISO 27001 certified. Infrastructure providers may publish their own reports and certifications; those do not certify this application or our company.
Can another company see our applicants?
TAPPEDIQ checks organization, location, role and journey access for protected applicant operations. Customer administrators manage their team’s permissions. Authorized support or infrastructure administration is a separate access context; we do not claim that no administrator or service provider can ever access data.
Is email verification the same as authenticator-app MFA?
No. TAPPEDIQ’s current additional sign-in check uses email codes. It is not an authenticator-app, passkey or hardware-key factor. Protecting the associated mailbox remains important.
Does a delivered email guarantee that it appears in an inbox?
No. Provider acceptance, recipient-mail-server delivery and inbox placement are different results. Spam filtering, quarantine and mailbox policies can affect where a message appears. Contact support if a security or hiring message does not arrive.
How do we request access, export or deletion of applicant information?
Applicants should contact the employer handling their application. Customer administrators can contact TAPPEDIQ support for help with available export, retention and deletion processes. Requests require appropriate authorization and consideration of applicable retention obligations.
Policies, evidence and a person to contact.
Request available security information, a questionnaire review or data-processing terms through our team. Provider reports can have access and redistribution restrictions. We do not offer an independent TAPPEDIQ certification report or represent this page as a legal compliance guarantee.
support@harnlyintertech.comFor suspected security issues, include a description and relevant time. Do not send passwords, verification codes, recovery links or applicant files. We’ll arrange an appropriate way to investigate.