Security
Your information, protected
People trust us with their CVs, photos, videos and contact details. This is how that information is kept safe, from the moment you press send until it is deleted.
Your application
- Encrypted at rest. Your name, contact details, cover note, CV, photo and video are encrypted (AES, with an HMAC-SHA256 integrity check) before they are written to disk or to the database.
- Files checked by their content. Each upload is checked by what it actually is, not by its name; only PDF, Word, JPEG, PNG, WebP, WebM and MP4 are accepted, within size limits.
- Your own private link. After applying you get a link to see your application's progress. Only a fingerprint (hash) of that link is stored, so it cannot be read back from our records.
- Delete it yourself. From that link you can withdraw your application, which deletes it and every file with it, straight away.
- Nothing personal by email. Alerts to our recruiters say only that someone applied; CVs, photos and videos never travel by email.
Applicants kept apart
- Row-level security in the database. PostgreSQL itself decides which rows each request may see, whatever the website asks for.
- No applicant sees another's information. Your private link opens your application and your files, and nothing else.
- Only recruiters see applications. Signed-in StaffSource recruiters see every application; the public website can add an application but never read one back.
- No way around it. The website's own database login is not an administrator, owns no tables, and cannot switch the protection off.
Recruiter access
- Two-step sign-in. A password of at least 14 characters and a code from an authenticator app, every time.
- Passwords stored safely. Hashed with Argon2, never stored as written.
- Guessing stopped. After five wrong attempts in 15 minutes, sign-in is paused for that account.
- Sessions that end. Sign-ins expire after eight hours.
- Least privilege. Recruiters work with applications; only administrators can add people or read the audit trail.
- Audit trail. Every time an application or file is opened, changed or deleted, who did it and when is recorded.
The website
- HTTPS only, with HSTS so browsers never fall back to an unencrypted connection.
- A strict Content Security Policy, so the browser runs only our own code: protection against cross-site scripting.
- Forms protected against cross-site request forgery, and limited per address to stop floods of fake applications.
- No trackers and no advertising cookies. The only cookies are the ones the site needs to work.
- Security headers that stop the site being framed by others, stop browsers guessing file types, and keep the camera and microphone to this site only, for recording your video.
The server
- A hardened server, configured to the CIS benchmark, with security updates applied every week.
- The website runs confined: its own unprivileged account, able to write only to its own data folder.
- The database is reached over an encrypted connection, with its own password, from this server only.
- Health watched around the clock, and restarted automatically if it stops answering.
Kept only as long as needed
- POPIA-aligned. We ask only for what recruitment needs, and only with your consent.
- Deleted after 365 days. Applications and employer enquiries older than that are deleted automatically every night, files included.
- Your rights. Ask to see, correct or delete your information at any time. See our privacy notice.
Your next move starts here
Apply in minutes, or tell us who you need. A real person will be in touch.