Insivo App
A multi-tenant SaaS web app for AI-powered employee interviews. Voice-first. The LLM is the core actor — question generation, live conversation, post-hoc synthesis.
The product behind the Insivo SaaS site. Organisations onboard, create research campaigns, and let employees speak to an LLM interviewer. Themes, sentiment and recommendations are synthesised automatically — backed by row-level-security in Postgres, streaming Whisper transcription, and Claude-driven synthesis with structured outputs.
/ Four layers of isolation
Tenant data cannot leave its tenant.
01 · Architecture
Tenant isolation enforced at four layers.
A multi-tenant HR platform leaks data if isolation lives only in the UI. So tenant scoping is enforced at four layers: JWT claims, middleware route gates, Postgres RLS policies, and materialised view filters. A missing scope at any one layer fails closed — never falls through.
Every server action runs inside a request-scoped transaction that SET LOCAL app.tenant_id from the JWT before any query. RLS policies read this and filter every row touched. No accidental cross-tenant joins are possible.
Stack
Compliance enforced at the data layer.
03 · Engineering Decisions
Trade-offs that paid off.
-
RLS over app-layer scoping
Putting tenant rules in the database means even an SQL injection or a developer mistake in a server action still can't leak data. Slight performance cost (~3ms per query) traded for a much stronger security posture.
-
Materialised views for dashboards
Aggregating sentiment and themes across 500+ responses live would be too slow. Refreshed on a 90-second cadence — operators don't need second-level freshness, p95 stays under 200ms.
-
Tool-use for LLM outputs, never free-text
Claude returns themes through a typed tool call validated by Zod. Free-text-then-parse breaks in production on long or non-English responses. Tool use means the dashboard can render synthesis without prompt-injection risk.
-
Chunked Whisper streaming over batch
Employees see partial transcripts as they speak. Reduces perceived latency from 30s to under 2s. The full audio is also retained for re-processing during quality reviews.
From interviewer to insight
Consent gates before recording.
A typed consent record is written into consent_events before any microphone permission is requested. Each tenant ships its own AVV (Auftragsverarbeitung) PDF and a per-language consent script. One-click subject-access export pulls every response, transcript, audio file and consent record by user ID into a signed zip.
Numbers from the production tenants.
Compliance enforced at every layer.
Row-level security in Postgres. Tenant-scoped consent before recording. AVV per organisation. One-click subject-access export.
