Security

How Invyte protects API keys, tokens and candidate data, and what we ask of you.

API keys

Each key is 256 random bits. Invyte stores only a keyed fingerprint (HMAC) of it, never the key, so even a copy of the database can't be used to call the API.
A key is shown once, when it's issued or rotated. Afterwards only its last four characters are shown.
Keys are accepted only in the Authorization header. A key in a URL or a request body is refused.
Every key expires (90 days by default, a year at most). Admins are emailed when a key is created and a week before it expires.
Revoking a key stops it on its next request. Rotation gives a new key with an overlap you choose (up to 7 days).
Keys can be limited to IP ranges, and to one Client or one Job.
A key never does more than its role allows, can't approve requests, can't send email in a person's name, and can't spend money unless an admin allows it.
If a key is pushed to a public GitHub repository, it's revoked automatically and your admins are told.

People connect their AI client through an OAuth sign-in. The client acts as that person, in one organization, with exactly their permissions, and loses access within a minute when the person's access changes.
Anything that emails people, costs money or can't be undone shows the person a review first.
Admins can turn AI connections off for the whole organization, and anyone can disconnect a client from Settings → Integrations.

Every call is limited to what the caller's role reaches. A Client-scoped key can never read another Client's Jobs.
Contact details are returned only when asked for, and only to those who may contact the Job's candidates.
Talent Hub adds follow each person's consent choice.
Request logs record which operation was called, when and how it went: never what was sent or returned.

Keep keys in a secret manager, never in code, URLs or logs. One key per system, with the smallest role that works.
Rotate keys on a schedule, and whenever someone with access leaves.
Treat candidate-written text (résumés, transcripts, notes) as data, never as instructions to your own AI.
Report a suspected issue to the Invyte team right away. If a key may have leaked, revoke it first.