Security & Responsible Disclosure

How we protect your data

• Traffic to the site is encrypted with HTTPS.
• Accounts use email and password with email verification; passwords are stored as salted hashes by our authentication provider and are never visible to us.
• CV files live in a private storage area. There are no public CV URLs — downloads use short-lived signed links generated for the signed-in owner.
• Every table holding customer data has row-level security enabled so the database itself refuses to return another person's rows. Authorisation is enforced on the server, never only in the browser.
• Credits, plan limits and entitlements are enforced server-side, so the browser cannot grant itself a plan or extra analyses.
• Card data is handled entirely by Stripe. Subscriptions only change after a Stripe webhook whose signature we have verified, and repeated events are processed once.
• Secrets (AI keys, service keys, webhook secrets) live in server-side secret storage and are never shipped to the browser.
• Uploads are limited by type and size, stored under a path derived from your user id, and error messages never echo CV content.
• Expensive operations — analysis, uploads, support submissions, sign-in and password reset — are rate limited.

We do not claim any security certification, and we do not claim to be immune to attack. We describe what is implemented so you can judge it.

Reporting a vulnerability

Email support@jobmatchireland.ie with the subject "Security report". Include what you found, the steps to reproduce it, and the impact you think it has. We aim to acknowledge within 2 business days and will keep you updated while we fix it.

Please do

• Test only against your own account and your own data.
• Give us reasonable time to fix an issue before publishing it.
• Report immediately and stop if you access anyone else's personal data by accident, and delete anything you retrieved.

Please do not

• Run denial-of-service, load or spam testing against the service.
• Access, modify, download or retain another person's data.
• Use social engineering or physical attacks against us or our providers.
• Publish user data, or hold information to ransom.

We do not currently run a paid bug bounty. We will not pursue action against good-faith research that follows this page.

If a breach affects you

We have an internal incident procedure covering assessment, containment, remediation and notification. If a personal-data breach is likely to result in a risk to your rights, we will notify the Data Protection Commission within 72 hours where required, and tell affected users what happened, what it means and what to do. See the privacy notice for your rights.