Account & billing
Data privacy and security
How your data is isolated, protected and exportable.
Tenant isolation
Every record belongs to one company. You only ever see your own company's data — there is no cross-company leakage. Client portal users are scoped even tighter, to a single client company.
Security
- Passwords are hashed; sessions use secure, http-only cookies.
- Sensitive stored secrets (email tokens, SMTP passwords) are encrypted at rest.
- Public forms are gated by reCAPTCHA, and auth endpoints have brute-force protection with account lockout.
Your rights
- **Export** — company admins can export all company data from Settings.
- **Deletion** — accounts can be deleted; deletion cascades across all your data with a grace period before the permanent purge.
- **Subject access requests** — candidates can submit a request through the public SAR form, fulfilled by the operator.