Security & Data Protection

1. Our Commitment to Security

At SafeReq, security and data protection are fundamental to everything we build. Our customers entrust us with job requisition documents and employment-related content for compliance analysis. We take this responsibility seriously and invest in robust security measures to safeguard your data at every stage of processing.

This document describes our security practices, technical safeguards, organizational controls, and data protection measures. SafeReq is an informational tool that identifies potential areas of concern in job requisitions; it does not provide legal advice. Similarly, this security overview is provided for informational purposes and is subject to change as we continue to strengthen our security posture.

2. Data Encryption

2.1 Encryption at Rest

All data stored in our systems is encrypted at rest using industry-standard encryption:

• Industry-standard encryption at rest for all data stored in our databases, including job requisition content, analysis results, and account information
• Encrypted database volumes and encrypted automated backups, managed by our cloud hosting provider
• Encryption key management handled by our cloud hosting provider's managed infrastructure

2.2 Encryption in Transit

All data transmitted between your browser and our servers is protected:

• TLS 1.2 or higher (Transport Layer Security) enforced for all connections
• HTTPS required for all web traffic with automatic HTTP-to-HTTPS redirection
• Strong cipher suites with forward secrecy to protect against retrospective decryption
• HSTS (HTTP Strict Transport Security) headers configured to prevent protocol downgrade attacks
• Internal service-to-service communication occurs over a private network that is isolated from the public internet

3. Access Controls and Authentication

3.1 User Authentication

SafeReq employs multiple layers of authentication security for customer accounts:

• Passwords are stored as salted cryptographic hashes using a recognized password-hashing algorithm; plaintext passwords are never stored
• Sessions are short-lived and renewed automatically, so an intercepted session credential is useful only briefly
• Rate limiting on authentication endpoints to slow brute-force and credential-stuffing attempts
• Email verification required for all new accounts
• Administrators can revoke a user's access immediately, ending any session already in progress

3.2 Role-Based Access Control

Access to data within the platform is governed by role:

• Principle of least privilege: Every user is granted only the minimum access necessary for their role
• Organization-scoped data: Access to customer data is confined to the organization it belongs to
• Granular permissions: Sensitive operations, such as managing team members or viewing billing history, require elevated permissions that an organization administrator controls

We describe our access-control model at this level deliberately. Customers evaluating SafeReq who need specifics for a vendor security review can request them under a non-disclosure agreement by writing to security@safereq.com.

3.3 Internal Access Controls

• SafeReq personnel access to production systems is restricted to authorized individuals who require it for their job functions
• Administrative access to customer data through the platform is logged in the audit system
• Production database access requires authenticated, encrypted connections with individual credentials
• Access levels are reviewed to ensure continued appropriateness as roles change

4. Infrastructure Security

4.1 Cloud Infrastructure

SafeReq is hosted on a managed cloud platform whose underlying data centers maintain SOC 2 and ISO 27001 certifications. Our infrastructure takes advantage of the platform's security capabilities, including:

• Private networking for databases and internal services, isolated from the public internet
• Managed TLS termination with automatic certificate provisioning and renewal
• DDoS mitigation provided by our hosting platform
• Managed, versioned service configuration reducing manual configuration errors

4.2 Application Security

• Parameterized queries: All database queries use parameterized inputs to prevent SQL injection; user input is never concatenated into SQL statements
• Input validation: All API endpoints validate and sanitize input data before processing
• Output encoding: Responses are encoded to prevent cross-site scripting (XSS) attacks
• CORS policies: Strict cross-origin resource sharing policies limit which domains can interact with our API
• Rate limiting: API rate limiting protects against abuse and brute-force attacks
• Dependency scanning: Third-party dependencies across our application, service and analysis components are scanned for known vulnerabilities on every change, and monitored continuously against published advisories

4.3 Network Architecture

The SafeReq architecture separates public-facing services from internal processing:

• Our analysis engine is not internet-facing and cannot be reached directly
• Database servers are not reachable from the public internet
• Internal services communicate over a private network
• Administrative and internal-only interfaces are restricted beyond ordinary customer authentication

5. Audit Logging

SafeReq maintains comprehensive audit logs for security-relevant actions across the platform:

• Authentication events: Login attempts (successful and failed), password changes, and account revocation
• Administrative actions: User management, role and permission changes, organization settings modifications
• Billing events: Purchases, plan changes, refunds, and payment transactions
• Analysis operations: Document submissions and analysis requests

Audit records are written to append-only storage and include a timestamp (UTC), the acting account, the action taken, the affected resource, and the source IP address. They are retained in accordance with our data retention policy and applicable legal requirements.

These logs record actions that change data or access rights. They are not a record of every read of a document, and we do not represent them as one.

6. Vulnerability Management

• Security Reviews: Code changes affecting security-sensitive areas (authentication, billing, tenant isolation, rate limiting) undergo focused security review before deployment
• Patch Management: Security patches for operating systems, frameworks, and libraries are evaluated and applied promptly, with critical patches prioritized for expedited deployment; base platform patching is handled by our managed hosting provider
• Dependency Monitoring: We monitor our open-source dependencies for newly disclosed vulnerabilities, both continuously against published advisory feeds and as an automated check on every code change, so a newly published advisory against something we depend on surfaces without waiting for someone to look
• Responsible Disclosure: We welcome reports from security researchers. If you discover a vulnerability, please report it to security@safereq.com. We request 90 days to address reported issues before public disclosure

7. Incident Response

SafeReq responds to security events using the following approach:

7.1 Detection and Triage

• Application logging and audit trails to detect and investigate anomalous activity
• Incidents are prioritized by severity, with security incidents affecting customer data treated as the highest priority

7.2 Containment and Remediation

• Containment measures such as credential revocation, access suspension, and service isolation
• Root-cause investigation supported by audit logs and immutable transaction records
• Post-incident reviews to identify improvements and prevent recurrence

7.3 Breach Notification

In the event of a data breach affecting customer data:

• Affected customers will be notified within 72 hours of discovery, as required by our Data Processing Agreement
• Notifications will include the nature of the breach, categories of data affected, and remedial actions taken or planned
• We will comply with all applicable breach notification requirements under CCPA/CPRA and other applicable laws
• We will cooperate with law enforcement and regulatory authorities as required
• A post-incident report will be made available to affected customers

8. Organizational Security

8.1 Personnel Security

• All personnel with access to customer data are bound by written confidentiality obligations
• Access to production systems is reviewed and adjusted when personnel roles change

8.2 Vendor and Sub-processor Security

• Third-party vendors that process customer data are assessed for their security and privacy practices before we engage them
• Vendors are contractually required to maintain data protection standards consistent with this policy
• Sub-processors are listed in our Data Processing Agreement and changes are communicated to customers in advance

8.3 Physical Security

SafeReq's infrastructure is hosted in our cloud provider's data centers, which maintain comprehensive physical security controls including 24/7 security monitoring, restricted access controls, video surveillance, and environmental safeguards (fire suppression, climate control, redundant power). SafeReq personnel do not have physical access to data center facilities.

9. Data Protection Practices

9.1 Data Minimization

We collect and retain only the data necessary to provide our services. We do not collect or store payment card details (these are handled exclusively by Stripe). Anonymous analysis sessions retain only severity-level results for a limited period. Account data is purged in accordance with our retention policy when no longer needed.

9.2 Tenant Isolation

Customer data is logically isolated by organization, so one customer cannot access another customer's documents, analyses or billing records. Tenant isolation is treated as a core security requirement: changes that touch it receive focused review, and it is covered by automated tests that run before deployment.

9.3 Backup and Recovery

• Automated daily database backups, encrypted at rest, managed by our cloud database provider
• Point-in-time recovery available through our managed database service

9.4 Secure Data Deletion

When data is deleted (upon account closure, data subject request, or retention period expiration), it is removed from active systems. Copies may persist in encrypted backups until those backups age out on their normal retention cycle, after which they are overwritten – point-in-time recovery would not otherwise be possible. Data restored from a backup is re-deleted. Business customers can request written confirmation of deletion under our Data Processing Agreement.

10. Compliance

• CCPA/CPRA: Our data handling practices are designed to meet the requirements of California privacy laws
• Data Processing Agreements: Available for all business customers upon request

11. Security Best Practices for Customers

We recommend that customers take the following steps to help protect their accounts:

• Use strong, unique passwords for your SafeReq account
• Do not share account credentials with unauthorized individuals
• Regularly review who has access to your organization and what role each person holds
• Limit user access within your organization based on role requirements
• Promptly remove access for personnel who no longer require it
• Report any suspicious activity to security@safereq.com immediately

12. Security Reporting and Contact

If you discover a security vulnerability, experience a security concern, or have questions about our security practices, please contact us: