Trust & sovereignty
Your interviews stay yours.
You trust Vocaway with your voice, your documents and your hesitations. Here is, in plain language, how we protect them: a French AI, minimized data, strong account protection and rights you can exercise in a few clicks.
Security, privacy & AI transparency
Sovereign AI
A sovereign AI: Mistral AI
Vocaway interviews run on models from Mistral AI, a French company, accessed through its API. Vocaway does not train any model on your interviews.
Mistral AI provides the AI recruiter's language models, the transcription of your voice (Voxtral), speech synthesis and the reading of uploaded documents.- As set out in our privacy policy, interview data is processed by Mistral AI in France, within the European Union.
- Vocaway requests that your content not be used to train or improve Mistral AI's models.
- No advertising, no reselling: your data is only used to run the service.
Your data's journey
What happens to your data
From your first sentence to the final report, every step is limited to what is needed to help you practice.
Your voice
The microphone is only active during the interview. Audio is sent encrypted (HTTPS) to our servers to be transcribed.
Transcription
Your voice is transcribed in real time by Voxtral (Mistral AI). The recruiter answers you with an AI-generated synthetic voice.
Evaluation
The transcript and your documents are analyzed by a Mistral AI model against the recruiter scorecard. Your documents are treated as plain data, never as instructions.
The report
Your report is saved to your account, where you can view and export it. For accounts linked to an institution, its administrators can access the results set out in the contract.
How long we keep it
- Transcripts, uploaded documents and reports
- Until you delete them: each interview and each uploaded document can be deleted at any time, and everything is erased along with your account
- Inactive individual or student account
- Deleted after 3 years without a login if there is no ongoing subscription, with a warning email sent 30 days beforehand
- Account with an unverified email address
- Deleted 30 days after creation
- Account you ask us to delete
- Permanently erased after a 30-day grace period
- Security logs
- 12 months maximum
- Invoices and accounting records
- 10 years (legal requirement)
Account protection
Strong locks, no hassle
Passwords hashed with Argon2id
Your password is never stored in plain text: we only keep an irreversible hash, computed with the recommended Argon2id algorithm.
Password policy aligned with the CNIL
At least 12 characters, a strength check and a lookup against a database of compromised passwords, without ever sending your password (only a fragment of its hash is transmitted). The CNIL is the French data protection authority.
Two-factor authentication
Enable a second factor with an authenticator app or a code sent by email, plus recovery codes in case you lose your phone.
Passkeys
Sign in with your fingerprint, your face or your device PIN using the WebAuthn standard, with no password to remember.
Control over your sessions
See your connected devices and sign out of one session or all the others in a single click. Changing your password signs out your other sessions.
“This wasn't me” alerts
New device, password or email changed: you are notified by email. A “This wasn't me” button instantly closes all your sessions.
Abuse protection
Rate limiting on sensitive actions and bot checks on sign-up and public-facing forms.
Encryption & infrastructure
Encrypted in transit, protected at rest
We apply web security best practices at every layer of the platform.
- All connections go through HTTPS, with HSTS to enforce encryption in your browser.
- Two-factor authentication secrets are encrypted with AES-256-GCM before being stored.
- A strict Content Security Policy (CSP), protection against embedding in other sites and verification of request origins.
- Payments via Stripe: your card details are entered on Stripe and never pass through our servers.
- Data access is limited to authorized personnel, with logging of sensitive actions.
Your rights
Your data, your decisions
Export
Download a copy of your data in a structured format from your settings.
Delete
Delete your account from your settings. You have 30 days to change your mind by signing back in.
Correct
Update your profile information at any time, directly from your account.
Complain
Write to us at contact@vocaway.com. If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority.
AI transparency
An AI that tells you it's an AI
In the spirit of the European regulation on AI (AI Act), we tell you clearly who you are talking to and what the result is worth.
An AI recruiter
The recruiter is not a real person. The voice you hear is synthetic, generated by AI.
Practice feedback
The evaluation is a learning tool with no legal effect: it is neither an official grade nor a hiring decision. It may contain errors.
A result you can challenge
You can challenge an evaluation or ask for it to be reviewed by a person by writing to support.
Processors
Who we work with
Each provider only accesses the data it needs for its task and acts on our instructions.
Mistral AI
- Role
- Language models, transcription (Voxtral), speech synthesis and document reading
- Location
- France (European Union)
OVHcloud
- Role
- Hosting of the application, databases and files (uploaded documents, reports exported as PDF)
- Location
- France
Stripe
- Role
- Online payments, subscriptions and fraud prevention
- Location
- Ireland, with possible transfers to the United States covered by European safeguards
Cloudflare
- Role
- Content delivery (CDN), web application firewall and anti-bot verification (Turnstile)
- Location
- United States, transfers covered by the EU-US Data Privacy Framework and standard contractual clauses
Brevo
- Role
- Sending of service emails
- Location
- France
Google
- Role
- Authentication, only if you choose “Continue with Google”
- Location
- Ireland and United States
The full, up-to-date list of our processors is available in our privacy policy.
Read the privacy policyResponsible disclosure
Report a vulnerability
Think you've found a security flaw? Write to us with a description, steps to reproduce and the estimated impact. We are grateful for every report made in good faith.
- Acknowledgment within 3 business days and a status update within 10 business days.
- No legal action against researchers acting in good faith, within scope and without retaining personal data.
- Out of scope: denial of service, social engineering, spam and physical testing.
- Credit for your contribution if you wish.
Frequently asked questions
Security & privacy
Vocaway does not train any model on your interviews and requests that Mistral AI not use your content to train or improve its models.
The content of your interviews is sent to Mistral AI, a French company, which processes it in France. The application, its databases and your files are hosted in France by OVHcloud. Only payments (Stripe), site delivery and anti-bot protection (Cloudflare) and Google sign-in, if you choose it, may involve safeguarded transfers to the United States.
You. Authorized Vocaway staff only access them to handle a support request or an incident. If your account is linked to an institution, its administrators can see the cohort information set out in the contract.
Yes. Each interview (transcript and report) can be deleted at any time from your history or from its report, and your uploaded documents from the “Prepare for an interview” page (“Manage my uploaded documents” section). You can also delete your entire account: deletion becomes final after 30 days; only invoices are kept to meet our legal obligations.
No. It is practice feedback with no legal effect. It is no indication of what a real recruiter would decide, and you can ask for it to be reviewed by a person.
We do not claim any certification at this time. Instead, we prefer to detail the measures actually in place on this page and in our privacy policy.
Ready to land your next job?
1 free practice credit when you sign up- No credit card required
- The recruiter's verdict and your action plan as soon as the interview ends
