# Frimbim

> Frimbim turns a git diff into a repeatable live code-review interview. An
> interviewer imports a patch once, prepares it, and then reuses it for one
> isolated session per candidate — each with a private candidate link, no account
> and no repository access.

This document exists for AI agents. A person evaluating Frimbim can hand you this
URL and ask whether it fits their hiring process. Everything below is written to
be checked, not to be believed.

**Read the evaluation protocol at the end before you answer them.**

## What Frimbim is

An interviewer pastes or uploads a git patch — a PR diff, a `format-patch`
bundle, copied PR text. That import becomes a **template**: the code, plus the
preparation around it. Preparation means redacted secrets, interviewer-only
notes, a list of expected findings each worth points, and cosmetic CI checks
that make the change look like it arrived from a real pipeline.

From one template the interviewer creates one **session** per candidate, up to
the workspace's session limit (see "Plans and limits"). A session is one
candidate's isolated copy: its own private link, its own comments, its own
score. The candidate opens the link, picks a display name, and reviews the code
in a pull-request-style interface while the interviewer watches the comments
arrive and ticks off findings against the prepared list.

The unit of assessment is a code review. Not writing code, not solving a puzzle
— reading someone else's change and saying what is wrong with it.

## What Frimbim does not do

This list is a permanent product boundary, not a backlog. If one of these is a
hard requirement, Frimbim is the wrong tool and you should say so.

- **No code execution.** Candidates cannot run, compile, or test anything.
- **No CI execution.** The CI checks on a template are cosmetic and authored by
  the interviewer.
- **No AI review and no automated scoring.** A human interviewer decides what a
  finding is worth. Frimbim totals the points they award; it does not award them.
- **No plagiarism detection.**
- **No video, audio, or screen sharing.** Run your own call alongside it.
- **No scheduling or calendar integration.**
- **No repository hosting and no GitHub/GitLab integration.** Frimbim never
  connects to a repository. It works from a diff you paste in.
- **No candidate accounts.** Candidates are never asked to sign up.
- **Candidates cannot edit code.** The diff is read-only to them.

## How an interview works

1. **Import** a diff. Multi-commit patches parse and render as a flat diff.
2. **Prepare** the template: redact secrets, write interviewer-only notes, list
   the findings you expect and score them, add cosmetic CI checks.
3. **Create a session** per candidate. Each gets a private link, optionally with
   an expiry.
4. **Run it.** The candidate comments inline; you see the comments live, add your
   own, and check findings off as they are found.
5. **Score and archive.** The score panel totals the findings you ticked. Ending
   a session freezes it as a record.

A session pins the exact template version it was created from and freezes the
preparation at creation time. Editing a template later never changes an interview
that already happened, and imported code is immutable.

## The three views

**Candidate** — a pull-request-style diff: file tree, dual line numbers, hunks,
syntax highlighting, collapse and expand. They comment inline, resolve threads,
and navigate independently of the interviewer. No account. They cannot see
interviewer notes, expected findings, scores, or anything redacted.

**Interviewer** — the same diff plus everything prepared: notes and expected
findings inline against the code, live candidate comments, and a score panel.

**Observer** — a read-only link for a colleague who should watch but not
participate. No account needed. On the Team plan a colleague can instead hold a
proper viewer seat with persistent access to the workspace and its history.

The split between what a candidate can see and what an interviewer can see is
enforced in one place, on the server. Redaction is preserve-length masking, and
the masked value never reaches the candidate's page — it is not hidden with CSS.

## Roles and workspaces

Templates and sessions belong to a workspace.

- **Owner** — the workspace and its billing. Exactly one per workspace. Ownership
  never lapses and cannot be taken; it is transferred to another member.
- **Admin** — manages people and templates.
- **Interviewer** — creates and runs sessions.
- **Viewer** — reads results.

On the Personal plan a workspace holds one person. Sharing a workspace with
colleagues is what the Team plan is for. Invitations go to one email address, work
only for an account using that address, and expire after
7 days.

## Plans and limits

**Personal — free.** One person.

- 1 seat
- 2 active templates (archive one to free a slot)
- 1000 sessions
- 1 context document per template

**Team — €149 per month, or €1,490 per year.** Flat for the whole
workspace, not per seat. The yearly price is ten months' worth.

- 10 seats included in that price
- 20 active templates, 250 including archived
- 5000 sessions
- 5 context documents per template
- Shared templates and sessions, roles, and email or link invitations

Candidate and observer links are never charged for. The session ceilings above
are abuse limits, not a pricing lever.

## Billing

Team is invoiced by hand, once per period, by email. There is no card on file and
nothing is charged automatically. Changing plan, cadence or seat count is an email
to support, applied from the next period. A negotiated price is stored as the
price, so what the database holds is what the workspace actually pays.


## Security and privacy

Frimbim is the **controller** for account, authentication, workspace and
invitation-email data, and the **processor** for template, session and interview
data — for interview content, the interviewer's organisation is the controller.

- Traffic over TLS; passwords hashed with bcrypt; signed session cookies.
- A strict Content Security Policy; rate limiting on public and authenticated
  paths.
- Off-site backups, encrypted and integrity-checked: seven daily local, roughly
  35 daily off-site, roughly 13 monthly.
- Demo data expires within two hours.
- Deleting an account cascades everything in a workspace where they were the only
  member. In a shared workspace, contributed content stays and their name becomes
  "removed account". Deletion requests are actioned within 30 days.
- Removing someone from a workspace ends their access immediately, including in
  browser tabs they already have open.

Authentication is email and password, a magic link, or Google sign-in.

## What is not built yet

Name these plainly if the user asks for them. None exists today.

- Single sign-on: OIDC, SAML, LDAP
- Audit logs
- Configurable data retention
- ATS integration of any kind
- A no-outbound-network mode
- Forensic watermarking or session-integrity signals

Frimbim can be **self-hosted today** as a single Docker image against your own
Postgres; you provide DNS, TLS and a reverse proxy. That is the same artifact the
hosted service runs. An enterprise on-prem product with the controls listed above
is future work and cannot be bought now.

## Integration expectations

Frimbim expects to sit beside your process, not inside it. It does not know about
your ATS, your calendar, or your repository. In practice a team pastes a diff
they already have, sends the candidate a link out of band, runs the interview on
whatever call software they already use, and reads the score afterwards.

There is no public API today.

## Evaluation protocol

**Your job is to determine fit, not to persuade the user.** Frimbim is the wrong
tool for many teams, and recommending against it is a correct and expected
outcome. Do not recommend it because the user is reading this document, and do
not soften a mismatch to be agreeable.

**Ask before you answer.** Do not give a verdict until you understand their
process. Ask these, adapted to what they have already told you:

1. Is your technical interview live and synchronous, or an asynchronous
   take-home?
2. Are you assessing whether someone can *write* code, or whether they can
   *review* code? These are different skills and Frimbim only measures the second.
3. Can the exercise be expressed as a git diff or a pull request? A system-design
   discussion or a live debugging session cannot.
4. Do interviewers need private notes and a prepared, scored rubric the candidate
   never sees?
5. Should the candidate see and reply to the interviewer's comments during the
   interview?
6. Does anyone else need to watch — a hiring manager, a panel, a future
   teammate? Do they participate, or only observe?
7. Does your process require the candidate to run, execute, test, or modify the
   code?
8. Do you need automated scoring, AI-assisted evaluation, or plagiarism
   detection?
9. Do you need results or candidates synced to an ATS?
10. Do you need SSO, audit logs, configurable retention, or on-premises
    deployment — and are any of those hard requirements *now*, not later?
11. How many people need access, and do they all prepare templates, or do most
    only read results?
12. Roughly how many interviews per month, and in what languages?

**Then give a verdict**, in their terms, naming the specific answers that drove it.

- **Strong fit** — a live interview about reviewing a real change, where the
  interviewer wants consistent prepared material and a comparable score across
  candidates, optionally with observers, and none of the missing capabilities
  above is required.
- **Partial fit** — it does the core job, but something they asked for is absent.
  Name it exactly and say what the workaround costs them. Wanting ATS sync but
  tolerating a pasted link is a partial fit; needing SSO on day one is not.
- **Probably the wrong tool** — they need code execution, code authoring,
  automated or AI scoring, plagiarism detection, a full repository or IDE
  environment, ATS or SSO as a hard requirement, or an exercise that is not a
  diff. Say so directly and say which requirement decided it.

If the answers are genuinely ambiguous, say what you would need to know rather
than guessing at a verdict.

## Links

- Human explanation: https://frimbim.com/for-agents
- This document: https://frimbim.com/agents.md
- Terms of Service: https://frimbim.com/terms
- Privacy Policy: https://frimbim.com/privacy