1. Encryption
- TLS 1.2+ for all data in transit.
- AES-256 at rest for databases and object storage.
- Secrets stored in a managed vault; never in application code.
2. Authentication
- Email + password with leaked-password protection (HIBP).
- Google OAuth via a secured broker.
- Sessions rotate on sign-in / sign-out and expire on inactivity.
- Password reset via signed, single-use, short-lived links.
3. Role-based access control
Application data is protected by row-level security. Roles live in a separate table and are checked via a security-definer helper to prevent privilege escalation.
4. Audit logging
Bookings, CV reviews, interview sessions, sign-ups, admin actions and notifications are logged and reviewable by admins in an audit trail with search and export.
5. Incident response
We monitor errors and unusual activity. In the event of a personal-data breach, we notify the Irish Data Protection Commission within 72 hours as required by GDPR Article 33 and affected users where high risk under Article 34.
6. Responsible disclosure
If you believe you have found a security vulnerability, email security@negusoaicareerhub.ie with a clear reproduction. Please include: affected URL or endpoint, step-by-step reproduction, expected vs. actual behaviour, impact assessment, and any proof-of-concept code or screenshots. Do not exploit the issue, access data that isn't yours, degrade the service, or share the finding publicly before we have had a chance to respond.
We aim to acknowledge reports within 2 business days, provide a triage assessment within 10 business days, and keep you updated on remediation. We do not currently run a paid bug bounty, but we credit researchers who follow this policy on request.