Security

How CoPilot Interview handles your audio, transcripts, AI prompts, and license data — plus our responsible disclosure program for security researchers. The short version: audio is captured on your machine and streamed in short encrypted segments to a speech-to-text provider through our proxy, only the question text and your context go to the AI model you chose, nothing is kept on our servers beyond the request itself, and your session files stay on your computer.

Data flow during a live session

Every session follows the same pipeline:

  1. Audio capture (local). The desktop app reads your microphone and, where you allow it, the meeting's system audio via the OS audio APIs. The recording buffer lives in the app's memory and is cleared after each answer.
  2. Transcription (encrypted to a speech-to-text provider). Short audio segments are sent over HTTPS through our proxy to a speech-to-text model (Groq Whisper; Google Gemini can hear the latest segment directly in the rare case the transcript is empty). The proxy forwards the audio and the text back; it does not keep either. The live captions you see are that text, held in the app's memory.
  3. AI prompt (encrypted to the model). The transcribed question, your resume and job-description context if you entered them, the recent Q&A of the session and a system prompt are sent over HTTPS through our proxy to the AI model you selected (Cerebras, Groq, Google Gemini, OpenAI, Anthropic or Inception).
  4. AI response (encrypted from the model). The answer comes back over the same connection and renders in the desktop app and its overlay.
  5. End of session. The transcript and answers are kept in app memory until the session ends, and the app saves a session file (questions, answers, the report) to your Documents folder. Nothing of it is uploaded.

What we never do

Never

Keep your interview audio. Segments pass through our proxy to the speech-to-text provider for the seconds it takes to transcribe them and are not written to disk or logged.

Never

Store the transcribed text of your interview questions, or your résumé, on our servers. The text passes through us only as part of the model request.

Never

Store the AI model's answers on our servers. They render directly in the desktop app and are saved only in your local session file.

Never

Sell or share your data with advertisers, recruiters, employers, or other third parties.

Never

Use your interview content to train AI models. We do not train models. We use third-party AI providers; their training policies are separately negotiated and respected.

Be aware

The speech-to-text provider hears your audio segments and the AI model you choose sees the transcribed text of your questions and the context you entered. Their data-retention and training policies apply; the API tiers we use default to no training on your data, but check each provider for current terms.

What we do store

  • Account email. Used for login and license-key delivery. Stored encrypted at rest in Supabase.
  • License key. One per paid plan. Tied to your email. Stored encrypted at rest.
  • Subscription status. Provided by Stripe. We store the tier and billing period; we do not store credit card numbers (Stripe handles those).
  • Usage metering. Minutes of live session time per license (for hour packs, the refund guarantee and abuse detection) and daily API call counts. We do NOT store the content of those sessions.
  • Diagnostics. Short telemetry events from the app — an audio device failing to start, a rejected license, a caption pipeline restart — with no audio, transcripts or answers. If you rate a session, the stars and the comment you type are stored with your license.
  • Anonymous question stats (optional). After a 📊 Summary report the app can send the question titles with their category and difficulty, the interview type, the role/company/seniority if you entered them, the scores and the improvement areas — never your answers, transcripts, résumé, name or email, and not linked to your account. On by default outside the EEA, UK and Switzerland; the toggle is under every report and in ⚙ Options. Details in the privacy policy.

Encryption and transport

  • HTTPS/TLS 1.2+ for all API requests from the desktop app and the website.
  • Strict-Transport-Security with HSTS preload on copilotinterview.com.
  • API keys for AI providers are stored encrypted in the desktop app's local credentials store (OS keychain on macOS, DPAPI on Windows).
  • Cloudflare in front of the website with WAF rules and DDoS protection.

Ghost Mode / private desktop window

The desktop app's main window is rendered via the OS native window manager, not in a browser tab. This means:

  • Browser-based screen sharing on Zoom, Teams, and Google Meet only captures the browser tab being shared. The CoPilot Interview window is not in that tab and therefore not in the share.
  • Full-display screen sharing WILL show all windows including ours. Users who do full-display sharing can lower CoPilot Interview's opacity to make it visually unobtrusive, or move it to a secondary monitor.
  • Most candidates use tab/window sharing rather than full-display, by interviewer convention.

This is a UX feature, not a defeat-the-interviewer guarantee. The screen-share-safety claim covers the common case of standard-window sharing; users are responsible for understanding their own interview-platform settings.

Responsible disclosure program

If you are a security researcher, ethical hacker, or curious engineer who finds a vulnerability in the CoPilot Interview desktop app, this website, or our API, we want to hear from you. We run an informal community bug-bounty program based on responsible disclosure principles.

How to report a vulnerability

  • Email support@copilotinterview.com with subject starting with Security:
  • Or use the contact in our /.well-known/security.txt file (RFC 9116, the standard for security contact disclosure).
  • Include reproduction steps, affected version or URL, expected vs actual behavior, and any proof-of-concept code if you have it.

Our commitment to you

  • Acknowledged within 1 business day. Every responsible-disclosure report gets a human reply, not an autoresponder.
  • Triage within 5 business days. We'll confirm severity, scope, and a patch timeline.
  • Public credit on request. Valid reports get researcher credit in our changelog and a thank-you on this page (with your permission).
  • Swag for the first reporter. The first researcher to report a valid issue gets CoPilot Interview swag mailed to them.
  • No legal action against good-faith research. We will not pursue legal action against researchers who follow this responsible-disclosure policy.

What we ask in return

  • Give us 90 days from the date of your report to investigate, patch, and notify users before public disclosure.
  • Don't access, modify, or delete data that doesn't belong to your own test account.
  • Don't run automated scanners or brute-force tools against production. (We do see them; they trigger our WAF.)
  • Don't perform social-engineering attacks on our team or customers.
  • Don't publish or sell vulnerability details before we've had time to patch.

In scope

  • The desktop app (Windows and macOS builds from downloads.copilotinterview.com)
  • copilotinterview.com and all subdomains
  • The Stripe checkout integration where it touches our endpoints (NOT Stripe itself)
  • The Supabase-backed account and licensing API

Out of scope

  • Vulnerabilities in third-party AI providers (Inception, OpenAI, Anthropic, Google, Groq, Cerebras) — report those to the providers directly
  • Issues only reproducible on outdated browsers or unsupported OS versions
  • Self-XSS, missing security headers without a demonstrated exploit, descriptive error messages, or theoretical issues without proof-of-concept
  • Rate-limiting or DoS bugs on public endpoints (a feature, not a bug, for an unauthenticated demo page)
  • Reports generated by automated scanners without manual verification

About the bug bounty

We do not currently run a paid bug bounty program with cash rewards — we are a small team and cannot match the budgets of HackerOne or Bugcrowd platforms. We do offer swag, public credit, and our genuine gratitude. As the company grows, paid rewards are on the roadmap. If you find an issue and would prefer cash compensation, let us know in your report and we will see what we can arrange on a case-by-case basis.

Questions?

For privacy-policy, data-handling, or enterprise data-residency questions, email support@copilotinterview.com.