JobClaySecurity
How we keep your board and its people safe
Your board holds your employers, your job seekers and your revenue. Here is what we do about it, in plain words. Everything on this page is how JobClay works today.
-
Every board’s data is kept apart
Each board’s data is tied to that board in the application and in the database itself, where PostgreSQL row-level security is forced on the tables. A test suite checks every API endpoint to confirm that one board cannot read or change another’s data.
-
Sign-in is bound to one board
A sign-in token works on the board it was issued for and is refused on any other. Cookies are set only over HTTPS, are not readable by scripts, and are tied to the exact host that set them.
-
Two-step sign-in for operators
Board operators can turn on two-step sign-in with an authenticator app, and then every sign-in asks for a code.
-
Our own staff sign in with Google only
JobClay staff sign in only with Google. No staff sign-in accepts a password.
-
Card details go to Stripe
Card payments are taken by Stripe. Card details go straight to Stripe and never reach JobClay.
-
Where data lives
Our servers and database are at Hetzner, in Finland. Email and uploaded files are on Amazon Web Services, in India. The privacy policy lists our providers.
Report a vulnerability
If you find a security problem in JobClay, write to hello@jobclay.com and say what you found and how to reproduce it. A person on the team reads it. Please give us a chance to fix the problem before you share it.
For how we handle personal data, read the privacy policy.
Start your job board today
Free plan, no card needed.