Skip to main content

Platform Architecture & Security

XeCubes is engineered for high throughput, data sovereignty, and zero-compromise candidate privacy. This document outlines our data lifecycle, vector indexing pipelines, and security controls.

High-Level Architecture​

The platform is divided into four core microservice domains:

  1. API Gateway & Ingress Layer:

    • Cloudflare Enterprise DDoS shielding and automated TLS 1.3 termination.
    • Redis-backed distributed token-bucket rate limiter.
    • HMAC key verification and tenant routing.

  2. Core Hiring Engine (Node.js & Go):

    • Stateless orchestration for job configuration, pipeline transitions, and candidate evaluations.
    • Event-driven worker pool processing asynchronous resume batches and webhooks.

  3. ResDB Semantic Sourcing Cluster:

    • High-dimensional vector embeddings generated using fine-tuned embedding models.
    • PostgreSQL with PgVector extension running HNSW (Hierarchical Navigable Small World) indexing for millisecond-speed similarity search across millions of candidate profiles.

  4. AI Interview Real-Time Studio:

    • Ultra-low latency WebRTC media gateways.
    • Real-time Speech-to-Text (STT), conversational LLM evaluation agent, and Text-to-Speech (TTS) pipeline.
    • Vision & audio proctoring detectors analyzing audio pitch, background voices, and camera occlusion.
flowchart LR
    Candidate([Candidate]) <-->|WebRTC A/V Stream| RTServer[WebRTC Studio Node]
    RTServer <-->|Low-Latency WS| AIEngine[AI Evaluator & Proctor]
    AIEngine -->|Scored Transcript| CoreDB[(Relational DB)]
    
    Recruiter([Recruiter / ATS]) -->|REST API| Gateway[API Gateway]
    Gateway --> CoreMesh[XeCubes Core Mesh]
    CoreMesh <--> CoreDB
    CoreMesh <--> ResDB[(ResDB PgVector)]

Security & Compliance Standards​

1. Data Encryption​

  • In Transit: All ingress and internal RPC network traffic is strictly enforced over TLS 1.3 using modern cipher suites.
  • At Rest: Database instances, cold backups, and object storage buckets (S3 / Cloud Storage) utilize AES-256 GCM disk-level encryption. Sensitive fields (API tokens, OAuth refresh secrets) are enveloped with tenant-specific master keys.

2. Multi-Tenant Isolation​

  • Strict logical row-level security (RLS) partition by org_id.
  • Tenant boundaries are cryptographically enforced at the gateway: an API token or session JWT bound to org_A can never query or mutate resources belonging to org_B.

3. AI Safety & Non-Bias Controls​

  • Automated candidate evaluation rubrics are evaluated against standardized competencies rather than demographic attributes.
  • System prompts enforce strict anti-bias guidelines complying with EEOC and EU AI Act employment hiring standards.

4. GDPR & Candidate Data Rights​

  • Candidates retain full rights to request data portability and deletion ("Right to be Forgotten").
  • When a candidate profile is deleted, all corresponding vector embeddings, interview recordings, and parsed resume archives are permanently scrubbed within 30 days.

System Availability & Resilience​

  • SLA Commitment: 99.9% uptime across production clusters.
  • Multi-Region Redundancy: Automated failover with read replicas across US-East, EU-Central, and APAC regions.
  • Real-Time Status: Check platform health and scheduled maintenance at https://xecubes.com/status.