# Security — Criterio Talent

> A separate environment per client, mandatory second factor, permissions by team and role, an access log, and retention that enforces itself.

URL: https://criteriotalent.com/en/seguridad/

---

**Security**

# What your security team is going to ask, answered.

Five short answers for the review that always arrives: where the material lives, who can get in, what the candidate is told, and when all of it is deleted.

The detailed statement for your implementation is delivered in writing with the contract.

## Every client in its own environment

Each implementation gets its own cloud project, database, storage, domain and credentials. There is no shared database with a column saying which row belongs to whom.

The difference matters on the day something breaks: an error in a shared filter can show one client’s data to another, and with separate resources that error has no way to happen.

## Who gets in, and what they can see

- Mandatory second factor for authorised staff.
- Permissions by team and by role: seeing a report is not the same as downloading a recording.
- Audited onboarding and offboarding, with departures logged as carefully as arrivals.
- A searchable, timestamped log of access, publications, assessments and downloads.
- The database has no public address, and no secret is shared between clients.

## What the person is told before it starts

Before a single second is recorded, the candidate reads what will be recorded, what it is used for, who is responsible for the processing and how long it is kept. Until they expressly accept, there is no conversation.

Rights of access, rectification, cancellation and objection are exercised with the contracting company, and each instance’s privacy notice publishes the specific channel that handles them.

## The material has an expiry date

The retention period is agreed in the contract and enforces itself: on the date, the purge deletes the material and leaves a record of what it deleted. Nobody has to remember to run it.

Storage also has its own expiry behind that, deliberately longer than the promised period, as a net for whatever the purge does not reach.

## For the formal review

An interview with voice and audiovisual presence is produced by several specialised services alongside the cloud provider. The statement delivered with the contract names them one by one and says what information each receives.

Where each part of the processing happens, which specialised services take part and under what conditions, is named one by one in that statement. If your team has a vendor questionnaire, the way in is to write to us and we answer it against that statement.

**Next step**

## See it with a role of yours on the table.

Thirty minutes: an interview is defined from your job post, walked through the way the candidate sees it, and a report is read with its evidence.