Development data deserves clear controls.
Talentonics gives administrators visibility into access, adoption and follow-through. Here is what the platform implements today and what still needs agreement before an enterprise rollout.
Identity and access
- Google OAuth with verified email, or short-lived email magic links. Database sessions use secure, HTTP-only cookies in production.
- Workspace-specific OpenID Connect SSO with PKCE, state, nonce, issuer, audience and signature validation. Company sessions are scoped to their workspace.
- Administrators can require company SSO after testing their own sign-in. Google and email sessions then cannot access that workspace. MFA and conditional access are managed in the customer’s identity provider.
- SCIM 2.0 User and Group provisioning, with expiring, revocable workspace tokens stored as hashes. Deactivation removes membership and revokes sessions. Provisioning cannot grant administrator roles.
- Role-based access, last-administrator protection, separate workspace ownership for financial actions, explicit reviewer assignments and server-side authorization backed by PostgreSQL row-level security.
Customer identity connections need configuration and a successful test with their own provider. SAML, automated domain-based joining and IdP back-channel logout are not implemented.
Data protection
- HTTPS, verified TLS to PostgreSQL, private responses marked no-store, clickjacking protection and browser capability restrictions.
- SSO client secrets are encrypted before database storage. Provisioning tokens are shown once. Credentials and provider token responses are excluded from application logs.
- Feedback visibility follows cycle stages: independent collection, manager calibration and release to the assessed participant.
- Workspace adoption reports count activity and development workflows. They do not copy assessment observations into analytics or rank employees.
- Participant privacy requests, administrator responses, scoped JSON export and a previewed retention purge for eligible released cycles.
Retention purges require administrator review. Roster, account, billing, audit and backup retention are separate operating decisions. A privacy-request status change does not automatically erase or correct records.
Administration and accountability
Workspace administrators control members, participation, sessions, identity configuration and data governance. The platform owner sees workspace operations, trial requests, subscriptions and adoption counts. The owner dashboard does not display assessment text or coaching evidence. Trial approvals, access changes, provisioning changes, exports and purges create audit entries.
The application’s privileged database connection can access stored records for authorised operations. This is application isolation, not end-to-end encryption or an independent immutable audit archive.
Hosting and service providers
| Provider | Purpose | Current configuration |
|---|---|---|
| Supabase | PostgreSQL storage | London project; verified TLS connection |
| Vercel | Application hosting | Functions configured for London; delivery, logs and platform operations may involve other regions |
| Resend | Sign-in and invitation emails | Verified talentonics.com sending domain; EU sending region |
| Google / company IdP | Identity verification | Only when that sign-in method is used |
| Stripe | Hosted subscription checkout | Isolated sandbox currently; real charging is not active |
Regional configuration is not a guarantee that every subprocessor operation stays in the UK. Agreements, backup locations, retention and applicable international transfer safeguards must be verified for an enterprise contract. Current assessment observations are not sent to an AI provider.
Assurance status
Talentonics has automated access-isolation and protocol checks. No SOC 2 or ISO 27001 certification, independent penetration-test report, contractual uptime SLA, or completed GDPR legal assessment is claimed. Backup restore testing, incident-response exercises and customer-specific identity-provider acceptance tests remain operational readiness work.
GDPR accountability includes organisational measures and evidence, alongside technical controls. See the ICO’s accountability guidance. The operator and account-processing bases are identified in the privacy notice. Customer processing agreements, transfer arrangements and the full retention schedule remain separate readiness work; no compliance statement is made.
For a security or privacy enquiry, contact hello@talentonics.com. This is a contact channel, not a promised incident-response SLA.
Read the data notice · See workspace pricing · Return to Talentonics