What we do, what we are doing, and what we have not done yet.

Encryption

In transit and at rest, with documented key management. Supporting documents are stored separately from report data.

Access controls

Role-based permissions enforced server-side, SSO for enterprise accounts, and least-privilege defaults for internal staff.

Audit logging

Every read, order, download and configuration change is logged with actor, timestamp and target — including internal access.

Secure document handling

Candidate uploads are scanned, access-scoped to the case, and excluded from report exports unless explicitly attached.

Data minimization

We request the fields a product needs and no more. Fields an employer did not order are not collected.

Data retention

Retention is set per record type and executed on schedule. Deletion is logged; it is not a request that sits in a queue.

Incident response

A documented process with defined severity levels, internal escalation and customer-notification obligations.

Vendor governance

Subprocessors are reviewed before onboarding and listed publicly. Material changes are published.

Accessibility

WCAG 2.2 AA is the design and build target across marketing, employer app and consumer surfaces.