Applicant interview videos shared beyond the people and services that evaluate the applicant

Keep interview videos in private storage and share them only with recipients on an evaluator allowlist (hiring team, AI analysis vendor), through short-lived links issued after that check.

Interview videos live in a private bucket or container (block public access; no public-read ACL; no 'anyone' link permission). Every path that shares a video (a signed URL, an email or ATS attachment, a vendor upload, an export) goes through one function that checks the recipient against an allowlist of evaluator roles and the contracted analysis vendor, issues a short-lived link, and logs who received which video. Videos are excluded from analytics events, marketing tools and any dataset used to train or evaluate models for other purposes.

Where it goes: 1 application source code, 4 infrastructure-as-code, 6 API calls and integrations, 12 repository artifacts.

What reviewers look for: interview-video storage with public access blocked (no ACL='public-read', make_public(), allUsers, or 'anyone' link permission); a share_video/issue_link style function that checks an evaluator allowlist before generate_presigned_url or an upload to a vendor; no interview video in analytics, marketing or push_to_hub calls.

s3.upload_file(path, 'interviews', key, ExtraArgs={'ACL': 'public-read'})
share_url = f'https://interviews.s3.amazonaws.com/{key}'
notify_team(job.slack_channel, share_url)

s3.upload_file(path, 'interviews', key)                      # bucket blocks public access

def share_interview_video(key, recipient):
    if recipient.role not in EVALUATOR_ROLES and recipient.id != ANALYSIS_VENDOR_ID:
        raise PermissionError('not an evaluator of this applicant')
    url = s3.generate_presigned_url('get_object', Params={'Bucket': 'interviews', 'Key': key}, ExpiresIn=900)
    share_log.record(key=key, recipient=recipient.id)
    return url

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.