Security at Job Flir

Job Flir is a multi-tenant SaaS platform. Each customer workspace is logically isolated by row-level security (RLS) and role-based access control. Defence in depth, least privilege, and secure-by-default are core engineering principles.

• SOC 2 Type II — audit in progress
• ISO/IEC 27001 — controls aligned, certification roadmap
• GDPR & UK GDPR — DPA available, EU SCCs and UK IDTA in place
• CCPA/CPRA — service-provider terms available
• PCI DSS — card data handled exclusively by a Level 1 processor
• HIPAA — not in scope (do not upload PHI)

Production runs on enterprise cloud providers operating ISO 27001, SOC 2, and PCI DSS-certified data centres in the EU and US. Network access is restricted by security groups, private networking, and managed firewalls. Production and non-production environments are fully isolated.

• TLS 1.2+ for all data in transit, with HSTS preload.
• AES-256 for data at rest, including databases, object storage, and backups.
• Managed KMS for key storage with automated rotation.
• Passwords hashed with a modern, salted KDF; never stored in plaintext.

Customer access uses email + password (with leaked-password checks via HIBP) and Google SSO. SAML SSO and SCIM are available on enterprise plans. Internal access to production requires SSO, hardware-backed MFA, and just-in-time approval; access is least-privilege and time-bound, and all sessions are logged.

Within the application, roles are stored in a dedicated table and evaluated by security-definer functions; every query is gated by row-level security policies bound to the authenticated user.

• Secure SDLC with mandatory peer review and CI checks.
• Static analysis (SAST), dependency scanning (SCA), and secret scanning on every change.
• Dynamic application security testing (DAST) on each release.
• Annual third-party penetration tests; remediation tracked to closure.
• OWASP ASVS Level 2 as a baseline.

AI inference is brokered through our gateway. Prompts and completions are not used to train third-party models, and our AI providers are contractually bound to that restriction. Model outputs are returned with the deterministic score breakdown so that recruiters can review and override them.

We collect application, infrastructure, and security logs in a central, write-restricted store with integrity protection. Alerts are generated for anomalous authentication, privilege changes, and known attack signatures, and are routed to an on-call rotation 24/7.

We maintain a documented incident response plan with defined severities, roles, and communication paths. We will notify affected customers without undue delay and within the timeframes required by applicable law (for GDPR, within 72 hours of becoming aware of a notifiable breach).

Databases are continuously replicated with point-in-time recovery and encrypted off-site backups. Our recovery objectives are RPO ≤ 1 hour and RTO ≤ 4 hours for the production database. Plans are tested at least annually.

Sub-processors are reviewed for security, privacy, and data residency before onboarding and at least annually thereafter. All sub-processors are bound by written contracts with confidentiality, security, and data protection terms (including SCCs/IDTA where required).

Employees and contractors complete background checks where permitted by law, sign confidentiality agreements, and complete annual security and privacy training. Access is provisioned via role-based groups and revoked on the same day employment ends.

We welcome reports from security researchers. Please email security@jobflir.com with steps to reproduce. We commit to acknowledge within 2 business days, provide a triage update within 5 business days, and not to pursue legal action against good-faith research that respects this policy. Do not access data that isn't yours, do not run automated scans against production without prior approval, and do not perform DoS or social-engineering tests.

security@jobflir.com for security questions, vulnerability reports, or trust documentation requests.