Security

Our approach

JOBLINKD holds career information that people would not want made public. We treat it accordingly.

What we do

• Encryption. All traffic uses TLS 1.2 or higher. Data is encrypted at rest.
• Row level security. Access rules are enforced in the database itself, not only in the application. One user cannot read another user's Career Passport or applications even if the application layer were bypassed.
• Least privilege. Staff access is granted by role, reviewed regularly, and revoked on departure. Administrative access requires multi factor authentication.
• Secrets. API keys for third party services are held server side and are never shipped inside our mobile applications.
• Backups. Automated daily backups with point in time recovery, stored encrypted.
• Logging. Administrative actions are logged and retained for audit.
• Hosting. Australian data centres where available, with contractual protections where a provider processes data overseas.

What you should do

• Use a password you do not use anywhere else.
• Do not share your account.
• Be cautious of any message asking you to pay to apply for a job, or asking for bank details, your Tax File Number or identity documents before you have a written offer. Report it to us.
• Sign out on shared devices.

Reporting a vulnerability

If you believe you have found a security vulnerability, email hello@joblinkdapp.com with enough detail to reproduce it. Please give us reasonable time to fix it before disclosing it publicly. We will acknowledge within 3 business days. We do not take legal action against researchers who act in good faith, avoid privacy violations and do not degrade our service.

Data breaches

We maintain a response plan. If a breach is likely to result in serious harm we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.