Enterprise Security

Every request is authenticated with httpOnly JWT cookie sessions (secure and sameSite-protected in production) and authorised through role-based access control. Owners, HR managers, employees, clients and candidates each see only what their role permits.

Multi-tenant isolation is enforced at the data layer: queries are scoped to your company account, so one tenant can never read or modify another’s records. Sensitive actions across the platform are written to an audit log with user, action, target and time.

Capabilities

• httpOnly, secure, sameSite cookie sessions
• Role-based access control across all portals
• Tenant isolation scoped to your company account on every query
• Audit trail for sensitive administrative actions
• Login rate limiting and lockout protection
• TLS-encrypted connections in transit