Trust

Passwordless by default

Most people sign in with a one-time code or a sign-in link sent to their email, so there is no password to reuse or leak. One-time codes are stored hashed and expire.

Passwords, where used

Stored as bcrypt hashes, never in a readable or reversible form. We cannot see your password and cannot tell you what it is.

Google sign-in

Available as an option. We receive only your name, email address and profile image.

Sessions

Signed session tokens with a bounded lifetime. Administrative sessions are shorter-lived and can be revoked centrally, which ends access immediately rather than at expiry.

Every authorisation decision in the platform goes through a single evaluator rather than being scattered across screens. It is a pure function: given who is asking, what they want to do, and what they want to do it to, it returns a decision and a reason. Permissions are re-read from the database on every request. A session token carries an identity, never a role or a privilege level, so revoking access takes effect on the next request rather than when a token expires.

Reporting lines inside an organisation are structural information for display only. They are never a route to inherited permission: no authorisation decision walks a management hierarchy.

Where organisations embed our assessment in their own product, their data is isolated at the database level using row-level security, not only by application logic. One organisation’s records cannot be read through another’s, even if an application-layer check were missed.

Partner API keys are stored as hashes, so a copy of our database does not yield usable keys. API access is rate-limited per organisation, enforced in shared storage so the limit holds across all running instances rather than per-server.

• All traffic to and from the platform is encrypted in transit over TLS.
• Personal-data columns are explicitly annotated in our database schema, so it is possible to answer precisely what personal data exists and where.
• Administrative access to an individual's record is written to an append-only audit log.
• Deletion is a real cascade across every table holding that person's data, not a hidden flag. It is not reversible.
• Assessment results carry an expiry so a stale reading is not presented as current.

What we hold, why, and for how long is set out in the Privacy Policy.

If you believe you have found a security issue, email team@kirnova.com with the subject line Security. Include enough detail to reproduce it.

We will acknowledge within 48 hours and keep you updated until it is resolved. Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and do not access, modify or delete data belonging to anyone else while investigating. We will not pursue action against anyone who reports in good faith and follows those two conditions. We do not currently run a paid bug-bounty programme.

If a personal data breach occurs, we notify each affected person and the Data Protection Board of India, as the DPDP Act requires.

Kirnova turns data into intelligence through frameworks we build, such as TIGER for people decisions and BEAR for hard decisions, and through established methods where they fit better.

• Assessment results are worked out by fixed scoring rules, the same for everyone who answers. The same answers give the same result.
• Every reading is shown with the range it most likely sits in, not as one exact number.
• Where the evidence is too thin, the result says so instead of guessing.
• A result describes how a person tends to work, based on their own answers. It is not a verdict on who they are.

• AI does not score any assessment and does not decide anything about anyone.
• We apply outside AI models to write and summarise in plain words: answers in Kirnova Ask and BEAR Decide, and drafts that a person checks.
• Before text goes to an outside AI model, our software removes names and contact details.
• Every outside AI company we rely on is named on the Subprocessors page.

See the Subprocessors page

Kirnova informs a decision. A person makes it. There is no pass mark, no automatic rejection, and nothing that can be set up to work as one.

A result is not a substitute for interviews, references or work samples. The organisation that relies on it reviews it, weighs other information and takes the decision.

• TIGER has not yet been tested for unequal impact across language, schooling or region. We do not claim it is free of bias.
• No questionnaire tells you everything about a person. It tells you the same things about everyone, in the same words.
• A result describes how someone tends to work today. It is not a forecast of future performance.
• We have no outside study of results against job outcomes, so we make no claim of that kind.

• We hold no third-party security audit or certificate. Nothing on this page has been independently audited.
• We have not commissioned an external penetration test.
• Two-factor sign-in for administrator accounts is built but switched off today.
• We do not currently offer a customer-managed encryption key option or a data residency guarantee.

If any of these is a requirement for your organisation, tell us at team@kirnova.com. Knowing which ones block a deal helps us decide what to build next.

Some of what Kirnova shows comes from public sources that are shared on condition that they are credited. When a role is chosen for a job or an assessment, the list of departments, roles and job titles is built from these sources.

• This page includes information from the O*NET 31.0 Database by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA). Used under the CC BY 4.0 license. O*NET® is a trademark of USDOL/ETA. Kirnova has modified all or some of this information. USDOL/ETA has not approved, endorsed, or tested these modifications.
• This service uses the ESCO classification of the European Commission.
• Kirnova has modified and adapted the ESCO occupation names shown here: it sorts them into its own departments and merges them with titles from the other sources listed, so this is a modified version of ESCO and not the classification as published.
• This work includes material from OSCA – Occupation Standard Classification for Australia, 2024, Version 1.0, by the Australian Bureau of Statistics, used under the Creative Commons Attribution 4.0 International licence. Kirnova has modified and adapted this material.
• This work is based on/includes Stats NZ’s data which are licensed by Stats NZ for reuse under the Creative Commons Attribution 4.0 International licence.
• This work includes material from the National Classification of Occupations – 2015 (NCO-2015) of the Directorate General of Employment, Ministry of Labour & Employment, Government of India, used under permission held offline by the founder, recorded 2026-09-24. Kirnova has modified and adapted this material.

To report a security issue or ask about your own data, write to us with the subject line Security or Privacy. A person reads it.

Kirnova Systems (Registered partnership firm), PAN ABGFK2858K, Office at Plot 08, Eden Complex, Gangapur Road, Nashik, Maharashtra 422222, India. Grievance Officer: Yash Khatri.

team@kirnova.com · +91 85913 13113