Trust
Security
Effective: 2026-05-21 · Version 1.0
TalentOS handles candidate data, offer letters, salary information, and audit-grade hiring decisions for multi-subsidiary enterprises. This page summarises the controls we have in place today and the policy that governs how we work with independent security researchers. Every claim about the platform maps to code in our production deployment; nothing is aspirational.
Reporting a vulnerability? Jump directly to How to report or read the full coordinated disclosure policy. The machine-readable contact lives at /.well-known/security.txt.
Compliance posture — plainly
- SOC 2 Type II: in progress. Controls are documented and evidence is being collected; no report has been issued yet. We do not hold a SOC 2 Type I or Type II report today. Ask for our security packet (policies, architecture, sub-processors, pen-test summary when available) at security@talentosglobal.co.
- ISO 27001: not certified. We do not claim ISO 27001, HIPAA, or MAS TRM attestations anywhere in the product. Where a hosting region page mentions a provider certification it refers to Vercel / AWS, not to TalentOS.
- Uptime: no published historical figure yet. /status shows the live health probe and the incident log we maintain; a 99.9% availability SLA is offered contractually on the Enterprise plan.
- Data residency: a pinned preference, one physical region today. The app is deployed to Vercel Frankfurt (fra1) and Washington DC (iad1); the KV database lives in a single physical region. Choosing a region on /account records and locks your commitment and is the migration target — it does not yet route your bytes to a separate regional database.
Controls at a glance
Each control below is shipped code. “Env-gated” means the control is present in every deployment but activates only when the operator has configured the named secret; the live state is visible on /api/health.
| Control | Where | Posture |
|---|---|---|
| Encryption of secrets at rest (AES-256-GCM) | Account → AI provider, SSO, SCIM, SIEM | Env-gated: PLATFORM_DATA_KEY |
| Append-only audit log with CSV export | /audit, Settings → Security → Audit export | Always on |
| SIEM streaming (Splunk HEC / Datadog / webhook) | Account → SIEM | Always on; needs PLATFORM_DATA_KEY for tokens |
| Single sign-on (OpenID Connect) + SSO-required enforcement | Account → Single sign-on, Settings → Security | Env-gated: PLATFORM_DATA_KEY |
| SCIM 2.0 user provisioning | Account → SCIM | Env-gated: PLATFORM_DATA_KEY |
| Two-factor authentication (TOTP) + recovery codes; MFA-required roles | Account → Two-factor, Settings → Security | Always on |
| Session policy (max lifetime, idle timeout, revoke) | Settings → Security, Account → Sessions | Always on |
| Per-subsidiary access scope for recruiters and hiring managers | Team → member → Subsidiaries | Always on |
| IP allowlist (CIDR) | Settings → Security → Network | Enforced on authenticated API routes when set |
| Customer-managed encryption keys (CMEK) | Account → Encryption keys | Config accepted; activation requires operator KMS setup |
| Candidate data retention sweep | Settings → Security → Retention, nightly cron | Always on when a retention window is set |
| Candidate DSAR export and erasure (Art. 15/17/20) | /api/candidates/[id]/dsar/* | Always on |
| Tenant data export and deletion | Account → Privacy & compliance | Always on |
| hCaptcha on signup / login | Public forms | Env-gated: HCAPTCHA_SECRET |
| Error tracking (Sentry) | Platform | Env-gated: SENTRY_DSN |
Sub-processors
We use the following third parties to run the service. Each one processes data only to the extent needed for the function listed. We notify DPA customers by email before adding a sub-processor.
- Vercel Inc. — application hosting, edge network, KV (Upstash-backed) and Blob storage. US / EU (fra1, iad1).
- Upstash Inc. — Redis provider behind Vercel KV. Single region.
- Anthropic PBC — AI inference (Claude) for screening, drafting and chat, using the API key you configure. No training on API data under Anthropic's commercial terms.
- Resend Inc. — transactional email (invites, password resets, candidate notifications). Env-gated.
- Stripe Inc. — subscription billing, only when card checkout is enabled. Env-gated.
- Intuition Machines (hCaptcha) — bot protection on public forms. Env-gated.
- Functional Software (Sentry) — error tracking. Env-gated.
Data at rest
- Vercel KV (Upstash Redis) stores all tenant business data — vacancies, candidates, offers, audit log, sessions, library items, API keys. Encryption at rest is provided by the platform.
- Vercel Blob (CDN-fronted) stores binary uploads — CVs, JD attachments, assessment files, tenant logos. Each blob has an unguessable id and is access-gated by our /api/upload/[id] route.
- AES-256-GCM is applied on top of platform encryption for highly sensitive per-tenant secrets — customer-supplied Anthropic API keys, SSO client secrets. Derived from a 32-byte platform key never exposed to the client.
- Passwords never stored in plaintext. Hashed with scrypt (N=16384) + per-user 128-bit salt; constant-time verification via Node's
timingSafeEqual.
Data in transit
- TLS 1.2+ everywhere. The talentosglobal.co certificate is auto-renewed by Vercel; HTTP requests redirect to HTTPS at the edge.
- Outbound webhooks require HTTPS endpoints and are signed with HMAC-SHA256 (key = your webhook secret). Every payload includes a Unix timestamp in the signed envelope so receivers can reject replays older than 5 minutes.
- API tokens use a 67-character format (
tk_…+ 64 hex). Tokens are never logged; only the first 12 chars are persisted in plaintext for UI display. The full token is hashed on storage (same scrypt parameters as passwords).
Authentication
- Password policy: 12-character minimum, mixed character classes (or 16+ passphrase), and a Have I Been Pwned k-anonymity check on every signup + reset. Breached passwords are refused with the breach count surfaced to the user.
- Two-factor authentication (TOTP / RFC 6238) is available for every account from /account → Two-factor. 10 single-use recovery codes are generated at enrollment. Disabling 2FA requires a fresh password proof. Workspace admins can require MFA for specific roles from Settings → Security.
- Single sign-on (OpenID Connect) is available per tenant — admins paste their issuer + client id + client secret on /account → Single sign-on. Client secrets are encrypted at rest with the platform key. Admins can then require SSO, which disables password login for everyone except designated break-glass admins. SAML is not supported yet.
- Sessions are HttpOnly + SameSite=Lax + Secure cookies with a 14-day maximum by default; admins can shorten the maximum lifetime and set an idle timeout per workspace. Users can list and revoke active sessions from /account → Where you're signed in.
- hCaptcha protects /signup and /login when the operator has configured HCAPTCHA_SECRET — it bounces non-browser clients before any credential or rate-limit logic runs. Whether it is active on this deployment is visible on /api/health.
Tenant isolation
TalentOS is multi-tenant from day one. Every storage row carries a tenantId; every API route filters by the caller's tenant before returning data. Cross-tenant requests are masked as 404 (existence-hidden) rather than 403, so attackers cannot probe identifier space to discover what exists in other tenants.
The isolation gate applies to: vacancies, candidates, offers, interviews, library items, uploads (when tagged with a tenantId), audit events, AI cost attribution, webhooks, API keys, SSO config, and tenant settings.
Application security
- CSRF defence: every state-mutating endpoint checks the Origin header against an allow-list (apex, tenant subdomains, vercel.app preview hosts). Bearer-token callers (API integrations) bypass since they're not browser contexts.
- Rate limiting: per-IP on signup, login, anonymous CV uploads, 2FA verify, and password reset; per- session on every AI route (30 / minute).
- AI budget enforcement: tenants set a monthly USD cap on /account → Branding. AI routes return HTTP 402 (Payment Required) when the cap is reached.
- Per-tenant Anthropic key (BYO): tenants can paste their own Anthropic key on /account. When set, AI calls use that key — costs land on their Anthropic bill and rate limits stay isolated from other tenants.
Audit + observability
- Append-only audit trail: every create, update, delete, login, AI call, and config change writes an append-only event with actor, timestamp, entity, tenantId, and outcome. Admins export to CSV from /audit → Export. Honest limits: the log is not yet hash-chained, and the platform keeps a rolling window of recent events rather than a fixed multi-year retention — stream to your SIEM for long-term retention.
- Error tracking: Sentry captures uncaught errors across client + server when SENTRY_DSN is configured. Stack traces never include candidate documents.
- Health endpoint: /api/health exposes live posture — AI provider, email provider, captcha, storage probe, tenant count, audit error rate. Polled by /status and safe to monitor with external uptime tools.
Privacy + data-subject rights
We comply with NDPR (Nigeria), GDPR (EU + UK), CCPA / CPRA (California), POPIA (South Africa), LGPD (Brazil), PIPEDA (Canada), AU Privacy Act, PDPA (Singapore), and Kenya DPA 2019. Admins self-serve data export and tenant delete from /account — no support ticket required, no waiting period beyond the typed-confirmation step.
Full details on data we process, where it lives, and how to exercise data-subject rights live on the Privacy Notice and the Data Processing Agreement.
Infrastructure + uptime
- Vercel hosts the application in Frankfurt (fra1) and Washington DC (iad1). Deployments are atomic with instant rollback.
- Upstash backs Vercel KV. The database runs in a single physical region; backups follow the provider's snapshot schedule.
- Resend delivers transactional email from a DKIM-verified
talentosglobal.codomain (SPF + DKIM + DMARC configured). - Anthropic serves the AI workload. Calls are non-streaming where deterministic JSON is required and streaming for the AI Recruiter chat surface. No customer data is used for Anthropic model training (Anthropic's commercial-API privacy policy applies).
Coordinated vulnerability disclosure
We welcome reports from independent security researchers and treat coordinated disclosure as a partnership. The policy below mirrors the machine-readable contact published at /.well-known/security.txt per IETF RFC 9116.
In scope
talentosglobal.co(apex + www)*.talentosglobal.co— every tenant subdomain served by the platform (e.g.acme.talentosglobal.co)/api/*— every authenticated and public API route under the apex and tenant subdomains- The public career portal at
/careers/*and the anonymous CV upload endpoint - The platform's outbound webhook signing scheme and Bearer-token API surface
Out of scope
- Third-party platforms we build on — Vercel, Upstash (Vercel KV), Anthropic, Resend, Sentry, Stripe, hCaptcha. Report directly to those vendors' security teams. We're happy to coordinate where appropriate.
- Findings that require physical access to a user's device, social engineering of TalentOS staff, or compromise of a customer-owned account (those are tenant-side issues we can't fix on the platform).
- Missing security headers without demonstrated impact, clickjacking on pages with no state-changing actions, CSV injection in tenant-controlled export fields, and email spoofing of domains we don't control.
- Denial-of-service via volumetric traffic, automated scanner output without a reproduced finding, and self-XSS that requires the victim to paste attacker-controlled code.
- Best-practice notes without a concrete vulnerability (e.g. “cookie not HttpOnly” on a cookie that's not security-sensitive by design).
Safe harbor for researchers
If you make a good-faith effort to comply with this policy while researching a vulnerability, we:
- Will not pursue or support any legal action against you related to your research
- Will not report you to law enforcement for activity that stays within the bounds of this policy
- Will treat your research as authorised under the Computer Fraud and Abuse Act, the UK Computer Misuse Act, the EU NIS2 Directive, and analogous statutes — subject to the limits below
- Will work with you to understand and resolve the issue quickly, and credit you publicly (with your permission) in our changelog once the fix ships
In return, please:
- Make a good-faith effort to avoid privacy violations, degradation of user experience, or destruction of data
- Stop testing and report immediately if you encounter customer data; do not exfiltrate, copy, or retain it
- Don't run automated scanners at a rate that would impact service availability (start at ≤ 5 req/s and back off on errors)
- Test only against your own tenant or accounts you own; don't target real customer tenants or candidate records
- Don't publicly disclose the issue before we've had a reasonable opportunity to remediate (see the timeline below)
Disclosure timeline
Our default coordinated-disclosure window is 90 days from receipt. The clock starts when you send the report (not when we triage), and we'll keep you updated on progress at least every two weeks.
- Within 48 hours — acknowledge receipt and assign a tracking reference
- Within 7 days — initial triage result (validity, severity rating using CVSS 3.1, expected fix window)
- Within 30 days — fix shipped to production for High and Critical severity findings
- Within 90 days — fix shipped for all accepted findings, regardless of severity
- After fix ships — public credit in our changelog (with your permission) and CVE assignment for qualifying findings
If we need more than 90 days (e.g. for an architectural change), we'll explain why and agree an extension with you in writing before the window closes. We will not invoke legal escalation as a stalling tactic.
Rewards
TalentOS does not currently run a paid bug-bounty programme. We expect to launch one alongside our SOC 2 Type II audit (target Q4 2026); until then, valid reports receive:
- Public credit in our changelog and on this page's hall-of-fame section (with your permission)
- A swag pack (T-shirt, stickers) — confirmed by email once the fix ships
- Priority consideration if you later apply to TalentOS engineering or join our security advisory panel
How to report a vulnerability
The fastest channel is email. We monitor the inbox during business hours (UTC+1) and on rotation outside them.
The key currently published is a placeholder; a real keypair will be in place by 2026-09-01. Until then, send plaintext reports and we'll respond from the verified address before exchanging sensitive details.
What to include
- Affected URL, endpoint, or component
- Step-by-step reproduction (curl snippets, browser steps, or a minimal proof-of-concept script)
- Impact narrative — what an attacker could do, and the approximate user / data scope
- Suggested CVSS 3.1 vector if you have one (we'll score independently regardless)
- Your preferred name + handle for public credit (or “anonymous”)
If your report is time-sensitive (active exploitation in the wild, customer data at imminent risk), please put [URGENT] at the start of the subject line so the on-call engineer is paged.
Hall of fame
We publicly credit researchers whose reports led to a fix. The list will populate here after our first valid report — we'd be honoured for yours to be the first.
Incident response
If we become aware of a data incident affecting tenant data, we notify affected admins within 72 hours via the email on file with concrete details: what was accessed, by whom, for how long, and what's being done. We commit to the same 72-hour notification timeline that GDPR Article 33 requires of controllers.
Roadmap
Areas under active development:
- SOC 2 Type II audit — in progress; report targeted for Q4 2026.
- Hash-chained audit log and per-tenant multi-year retention.
- True per-region data routing (separate EU / US databases).
- Customer-managed encryption keys (CMEK) for tenants who require key sovereignty.
- SAML 2.0 (in addition to OIDC) for enterprise IdPs.
- Webhook auto-disable on consecutive failures (already shipped); next iteration adds per-tenant configurable thresholds.
- Published uptime history once /status has a full quarter of incident data.
Contact
- Security questions / pen-test reports: security@talentosglobal.co
- Vendor security review requests: hello@talentosglobal.co
- Live platform status: /status