Trust Center
Security & privacy at CipherForce
We staff cybersecurity teams — so we hold ourselves to the same standards we expect of the talent we place. This page summarises the controls and practices we operate today.
Data protection
Data is encrypted in transit (TLS 1.2+) and at rest. Production access is restricted to a small set of authorized engineers and is logged.
Access control
Role-based access with row-level security on every user-data table. Privileged roles are server-enforced and cannot be self-assigned during signup.
Data minimisation
We collect only what is needed to match candidates with employers. Candidate profiles are visible only to verified hiring teams under signed engagements.
Vendor & subprocessors
Core infrastructure runs on reputable cloud providers with SOC 2 / ISO 27001 attestations. We review subprocessors before onboarding.
Application security
- Authentication via managed identity provider with email/password and Google sign-in.
- Server-side authorization on every privileged endpoint; client-side checks are never trusted alone.
- Database row-level security policies scoped to authenticated users; default-deny posture.
- Inquiry forms validated server-side; internal fields cannot be set by anonymous submitters.
- Secrets stored in a server-only secrets manager — never shipped to the browser.
Privacy & your data
We process candidate and client data to operate the placement service. Candidates can request access to, correction of, or deletion of their profile data at any time by emailing us. Client contact information is used to respond to inquiries and manage active engagements.
Responsible disclosure
If you believe you have found a security issue in our platform, please report it privately to the address below. We acknowledge reports within 3 business days and will work with you on a coordinated fix. Please do not publicly disclose the issue until we have had a reasonable opportunity to address it.
Contact our security team
Security & privacy inquiries: hello@cipherforce.in
This page describes our current practices and is reviewed periodically. It does not constitute a third-party certification or independent audit attestation.