Security Overview

1. Encryption & Transit

• Data in Transit: All network connections are secured with HTTPS/TLS 1.3 using modern cipher suites. Unencrypted data transmission is strictly blocked.
• Passwords: User passwords are never stored in plain text. We secure them using strong, salted one-way hashing with the bcrypt algorithm on the server.

2. Access Control & Roles (RBAC)

The system enforces a strict Role-Based Access Control (RBAC) model at the FastAPI server layer:

• Information access is compartmentalized: candidates are physically isolated from recruiter evaluation scorecards, and recruiters cannot access candidate private evaluation diaries.
• Every API request verifies the authorized JWT token's rights to own and access the target resource (Vacancy ID, Interview, or Resume).

3. Multi-Factor Authentication (MFA)

For additional account security, we support two-factor authentication (2FA) utilizing the TOTP standard. You can link any standard authenticator app (e.g., Google Authenticator) in your profile settings to prevent unauthorized login.

4. Anti-Spam & Attack Mitigation

Public booking pages and login forms are secured against bot exploitation and credential stuffing:

• Cloudflare Turnstile: Integrated invisible captcha protects the scheduling form from automated booking floods.
• Login Lockout: Following 5 consecutive failed login attempts, the account is automatically locked for 15 minutes to block brute-force attacks.

5. Infrastructure & Backups

The backend servers and PostgreSQL database are isolated in a secure private network:

• Automated database backups are performed every 24 hours and stored in encrypted formats.
• OS security patches and software dependency packages are updated regularly to close known vulnerabilities.

Reporting Vulnerabilities

If you detect any potential security vulnerability in our service, please contact us directly at security@joblendar.com. We will promptly investigate all legitimate reports.