Security, with clear boundaries.

The scope of this overview

The marketing site explains the Vika suite. It has no product sign-in, shared product cookies, employee database, or candidate database.

VikaHire runs as a private test. Planned products do not inherit a security certification or a production-readiness claim from this page.

We make no claim of SOC 2 certification, ISO 27001 certification, or an independent penetration-test result here.

Access follows the task

VikaHire separates organization records and applies role permissions. Administrators control membership and access to hiring records.

Scout uses the current user's permissions. It asks for confirmation before it performs an action. Important security and hiring changes have audit records.

The audit log does not record every read or field change. Your team still needs to review access and hiring decisions.

Website and contact protection

Firebase Hosting serves the website over HTTPS. Browser headers restrict framing, content-type guessing, and access to the camera and microphone.

The contact service uses a separate database. Browser clients cannot read or write its records directly. Server credentials stay outside browser code.

When active, the service validates input, requires consent, limits requests, and records a receipt before email delivery. Repeated requests use the same delivery key.

These controls limit misuse. They do not prove the identity of a sender. Do not send passwords, employee records, or candidate data through contact.

Evidence before confidence

AI scores and suggestions support review. A person owns the hiring decision. VikaHire scores submitted words and work, not faces or voice emotion.

Untrusted content is data. A document, transcript, or model response must not grant permissions or replace an approval.

VikaLens is our planned supporting test engine. Regression tests can expose repeated failures; they cannot prove that an agent will never fail.

Service providers and data regions

This list covers the website, contact handling, and the VikaHire private test. Other product pages describe plans, not the same deployed configuration.

Provider retention and model-training terms depend on the service, account, and settings. We do not promise zero provider retention or India-only processing.

Google Cloud and Firebase

Website hosting, product infrastructure, and contact records.

Configured product infrastructure and contact storage: Mumbai, India (GCP asia-south1). Firebase Hosting serves website files through a global network.

Google Gemini

The default AI provider for VikaHire, including text assistance, scoring, and embeddings. Requests contain the data that each feature needs.

AI processing can occur outside India. The product infrastructure region does not fix the AI processing region.

OpenAI

VikaHire speech transcription and generated interview speech, when those features apply.

Processing can occur outside India. The deployment and provider settings determine the applicable data terms.

Sentry

Error reports from the VikaHire frontend and backend. This marketing site does not include a Sentry client.

US data region. Error reports can include technical context about a failed request.

Resend

Transactional email for VikaHire and the contact service when active.

The sender setup uses Tokyo. That setting is not a promise that every mail copy stays in Japan.

Google Workspace

The company mailbox receives enquiries and replies to them.

This notice makes no India-only storage promise for mailbox copies.

Report a security concern

Email hello@vikawork.com with the subject Security report. Include the affected URL, the time, and the steps that show the issue.

Do not include credentials or other users' records. Ask for a safe transfer method if we need more evidence.

Do not access another organization's data, disrupt the service, or run destructive tests. We do not promise a bounty or a fixed response time.