Security is a feature, not a document.

Six operative pillars

• Authentication

  Auth0 hosted login for every account. Session cookies are HttpOnly + Secure. SAML SSO available on Agency tier. API tokens (for the Chrome extension) are scoped to a single user, revocable in one click, and never returned in list responses.

• Tenant isolation

  Every candidate, job, submission and HR contact query runs through orgScope + visibilityScope. Cross-tenant leaks are the class of bug we treat as critical — Day 72's Cmd-K scoped-search fix explicitly proved candidate + job facets read 0 across orgs after the shipped rule.

• PII redaction on error tracking

  lib/observability/scrub.ts scrubs sensitive field names and stripped identifiers from every Sentry error report — including the thrown exception message. Browser tracing and session replay stay off unless the analytics consent category was granted.

• GDPR + consent

  Every captured email records a lawful basis in the candidate's own words. The consent-holds queue makes a human decide per candidate before invitation. Article-15 data export includes AI screening detail, interview assessments and recruiter notes — deliberately more than the softened portal view.

• Deliverability + rate limiting

  One email chokepoint enforced by a build-scanning smoke test that fails the build if any function other than sendResend calls Resend directly. Postgres-backed rate limits on signup, hire and join. A circuit breaker halts sending automatically when 24h bounce rate crosses 10%.

• Data at rest + in transit

  Postgres on managed Railway infrastructure. TLS 1.2+ enforced everywhere. Backups continuous; point-in-time recovery. Uploaded résumés and documents stored in AWS S3 with presigned URLs for retrieval — never bare public links.