Security

• TLS encryption in transit for web and API traffic.
• Hashed password storage and secure session management.
• Optional multi-factor authentication (authenticator app, email OTP, WebAuthn, or magic link).
• Role-based access controls for seekers, employers, and administrators.
• Server-side validation and authorized API access for sensitive operations.

• Hosted environments with least-privilege access for operational staff.
• Secrets and credentials stored outside application source code.
• Monitoring and logging to detect unusual authentication and platform activity.
• Dependency and platform updates applied as part of ongoing maintenance.

You can strengthen your account by:

• Enabling multi-factor authentication in Settings → Security.
• Using a unique, strong password and a password manager.
• Reviewing active sessions and revoking unfamiliar devices.
• Never sharing one-time codes or magic links with anyone.
• Confirming job details and payment instructions inside the Platform before acting outside it.

Personal and professional data is processed according to our Privacy Policy. Access to production data is limited to personnel who need it for support, reliability, or compliance. We avoid storing full payment card numbers on our systems; payments are handled by specialized processors.

If you believe you have found a security vulnerability, please report it through Support with enough detail for us to reproduce the issue. Do not access other users’ data, disrupt services, or publicly disclose a vulnerability before we have had a reasonable chance to investigate and remediate.

When we become aware of a security incident that affects personal information, we investigate, contain the issue, and notify affected users and regulators as required by applicable law. Our incident process prioritizes restoring service integrity and reducing user risk.

The Platform integrates with authentication, email, hosting, and payment providers. We select vendors that provide appropriate security assurances for their services, and we configure integrations with least privilege where practical.