Security and compliance

What we can show you, and what we are still working on

Statement 1.1 · 1 November 2026. Each item says whether it is in place today or planned. Documents marked "on request" are sent to employers evaluating or using Panayam; write to info@panayam.net.

1. Certifications

• SOC 2 Type 2 report Planned
  Not yet obtained. A SOC 2 report is issued by an independent auditor after an observation period; we will start one when a customer requires it. Until then, the security practices in section 6 are what we can evidence.
• ISO/IEC 27001 certificate Planned
  Not yet obtained. Same approach as SOC 2.
• Hosting provider certifications In place
  Panayam runs entirely on Google Cloud, which publishes its own independent certifications and audit reports in its compliance resource centre. Those reports cover the infrastructure, not Panayam's application.

2. Regulatory documentation

• Data Privacy Act of 2012 (RA 10173), Philippines In place
  Every candidate gives explicit consent to an AI-conducted, recorded interview before it can start, and hears the same notice at the start of the call. A Data Privacy Act checklist, mapping each requirement to what the software does, is available to the employer's Data Protection Officer on request.
• National Privacy Commission registration Employer action
  The employer is the personal information controller and registers its data processing systems with the NPC. We supply the system description and security measures needed for that registration on request.
• EU GDPR On request
  Panayam serves employers in the Philippines today. A note on Article 22 (automated decision-making) describing why a human reviews every scorecard is available on request, for employers who screen candidates covered by the GDPR.
• HIPAA
  Not applicable. Panayam processes no health information.

3. Legal agreements

• Data processing agreement Before go-live
  Panayam acts as a personal information processor for the employer. An outsourcing and data processing agreement under RA 10173 is prepared with each employer and signed before go-live.
• Fairness and data statement In place
  Published at Fairness and data and versioned. It sets out what the AI does and does not do, how scores are made and explained, what is never scored, and how candidate data is handled.

4. Subprocessors

Candidate data is processed by the following kinds of provider. We name the providers to employers under agreement and tell them before a provider changes; they are not named publicly because they can change.

• Cloud hosting, database and storage. Google Cloud, Singapore region. The only provider we name publicly.
• Real-time media network. Carries the live audio and video of the call and records it.
• Speech recognition. Turns the candidate's speech into text during the call.
• Language models. Run the conversation during the call and score the transcript afterwards.
• Voice synthesis. Produces the interviewer's voice.
• Email delivery. Sends interview invitations and scheduling links.

5. Region

• Data at rest. Candidate records, transcripts, scorecards, recordings and video frames are held in Google Cloud, asia-southeast1 (Singapore): a managed database for records and object storage for recordings.
• Data in transit. Audio and video travel encrypted between the candidate's browser, the media network and the interview engine. The recruiter console is served over HTTPS at panayam.net.
• Processing during the call. Live speech, language and voice providers process audio for the duration of the call to run the conversation.

6. Security practices

• Access control. Named logins with recruiter, user-admin and super-admin roles. Recruiters see only the roles they own or collaborate on. Administrative operations require a code from an authenticator app.
• Sessions. Session tokens are stored hashed. Sessions expire after inactivity and have an absolute lifetime. An administrator can view and end active sessions.
• Sign-in protection. Failed sign-ins and password-reset requests are rate-limited per address and per account.
• Audit trail. An activity log records sign-offs, sensitive reads and changes, with the actor, address and time.
• Safe updates. Maintenance mode stops new interviews before a software update so live calls can finish.
• Monitoring. Automated health checks and alerting run on every service; the public service status page shows current state and past incidents.
• Retention. Records are kept for the employer's hiring process. Automated deletion after a fixed period is on the roadmap pending the employer's retention policy; deletion on request is performed by the employer's administrator.

7. Requesting documents

Employers evaluating Panayam can ask for: the Data Privacy Act checklist, the NPC system description, the GDPR Article 22 note and the named subprocessor list. Write to info@panayam.net. This statement is versioned; when a status changes, the item and the version number change with it.