Security & Compliance

HTTPS / TLS in transit — All data exchanged between the browser and servers is encrypted end-to-end. Enforced by default on Vercel.

Encryption at rest (AES-256) — All data stored in our PostgreSQL database (Supabase) is encrypted at rest.

Row-Level Security (RLS) — Each employer client accesses only its own data. Supabase RLS policies enforce strict tenant isolation: Company A cannot access Company B's candidates or analyses.

Secure authentication — Candidate and recruiter accounts are protected via JWT-based tokens and secure session management (Supabase Auth).

Data minimisation — We collect only what is strictly necessary to connect candidates with employers.

Purpose limitation — Candidate data is used solely for recruitment matching. It is never sold, rented, or shared with third parties.

Retention policy — Candidate profiles and assessments are retained only for the duration of active use, with automatic deletion after 12 months of inactivity (planned).

Consent on import — Recruiters confirm they hold the necessary consent before uploading candidate CVs.

Right to erasure (Art. 17 GDPR) — Candidates may request permanent deletion of their profile, applications, uploaded CVs, and all associated data at any time. This is enforced via a self-service “Delete my account” function in the candidate dashboard, which triggers a full cascade deletion including Storage files and the authentication record.

Data portability — Candidates can export their profile data on request.

No third-party sharing — Candidate data is never passed to employers beyond what the candidate explicitly applies with.