Security

Protecting data

• Encrypted in transit: every connection to the Service uses HTTPS (TLS).
• Encrypted at rest: the database and file storage are encrypted on disk by our hosting provider, in data centres in the European Union.
• Private file storage: uploaded documents are stored privately. They are never published at a public web address and are only read by the Service's servers.
• Separation between customers: every request is checked against the signed-in account, so one customer can never see another's jobs, candidates or reports. The database also has row-level security switched on for every table.

Accounts and access

• Sign-in is handled by Clerk, a specialist authentication provider. We never see or store your password.
• Payments are handled by Paddle, which is PCI DSS compliant. Card details never reach our systems.
• Staff access to customer data is limited to what is needed to support the Service, and administrative actions are recorded in an audit log.
• Credentials and keys for our providers are stored as encrypted secrets on our hosting platform, never in our code.

Keeping the Service safe

• Notifications from our payment provider are verified with cryptographic signatures before they are acted on.
• Uploads are limited to PDF and Word documents up to 10MB, and requests are rate-limited to prevent abuse.
• Software dependencies are kept up to date, and every change is built and checked before it goes live.

Your data, your control

You can delete jobs, candidates and documents at any time. Retention and deletion are explained in our Privacy Policy and Data Processing Agreement.

Reporting a security issue

If you think you have found a security vulnerability, please tell us through privacy@careercatalystscreener.com and don't test it further or share it publicly. We will acknowledge your report, investigate promptly and keep you updated.