Data processing addendum (DPA)

Dokimos ID acts as a processor for candidate identity data on behalf of employer customers (controllers). This summary describes our processing commitments; a signed DPA is available on request for enterprise customers.

Processing scope

• Identity verification via Veriff (sub-processor).
• Live check during interviews: a Recall.ai bot records video for the employer's chosen window (default 60 minutes); frames of the candidate are compared by AWS Rekognition; recordings are deleted after the comparison and only scores and outcomes are retained.
• Generation and delivery of verification reports to the employer.

Security measures

• Per-organization tenant isolation enforced server-side.
• OAuth tokens and sensitive fields encrypted with AWS KMS.
• Webhook signature verification and idempotent handlers.
• Join links treated as secrets until verification passes.

Sub-processors

Key sub-processors include Stripe (billing), Veriff (identity verification), Recall.ai (meeting bot), AWS Rekognition (face comparison), AWS Lambda and KMS (frame processing and encryption keys), Zoom and Microsoft (meeting creation and calendar sync when the employer connects them), Resend (email), Convex (database), Clerk (authentication), Vercel (hosting), Upstash (rate limiting), Sentry (error monitoring), and PostHog (product analytics). A current list is available on request.

Request a DPA

Email hello@dokimosid.com with your organization name and billing contact.