Security overview

Hosting & data location

• The application is hosted on Vercel and served from the EU (Frankfurt).
• Our primary database is Neon (managed PostgreSQL) in AWS eu-central-1 (Frankfurt, EU). Personal data is processed primarily within the EU.
• See our Sub-processors for the current list of providers.

Encryption

• In transit: all traffic is encrypted with HTTPS/TLS.
• At rest: database storage is encrypted at rest by our infrastructure providers.

Authentication & access

• Passwords are never stored in plaintext — they are hashed with scrypt and a per-user salt.
• Sessions use server-side tokens in httpOnly, secure cookies that expire after 30 days.
• Job-seeker, employer, and internal areas are separated; role-based internal access with audited logins is being rolled out.
• Recruiter email addresses are masked from candidates.

Application & platform

• Bot/abuse prevention via reCAPTCHA on the application flow.
• Server-side input validation; database access via a typed ORM (parameterized queries).
• Source code is version-controlled with reviewed changes.
• Managed, encrypted backups are provided by our database provider.

Incident response

If a personal-data breach occurs, we will notify the competent supervisory authority (LfDI Baden-Württemberg) and affected individuals without undue delay — within 72 hours where required (GDPR Art. 33/34).

International transfers

Processing is primarily in the EU. Where any transfer outside the EEA/UK occurs, we rely on EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework through our sub-processors' data processing agreements.

Your rights & retention

You can access, correct, export, and delete your data — mostly through instant self-service. See our Privacy Policy. Retention periods are set out in our internal Data Retention Policy (available on request).

Contact

Security questions, or to request our sub-processors' DPAs / transfer safeguards: contact@personallyhired.com.