Your compliance data,
treated like it matters.
Safety records, insurance certificates, and workforce data are sensitive. Here’s exactly how we protect them — no vague badge-wall, just the practices.
Encryption in transit and at rest
All traffic is TLS-encrypted end to end. Data at rest — the database and uploaded documents — is encrypted by our infrastructure providers (Turso, Cloudflare R2).
Role-scoped access control
Every surface enforces a three-level permission model: platform admin, hiring-client organization, and contractor. Contractors see only their own data; hiring clients see only contractors connected to them; API routes verify the caller's role on every request.
Mandatory two-factor authentication for admins
Hiring-client admin accounts are required to enroll an authenticator app (TOTP). New admins get a short setup window from first sign-in; after that, access is limited to enrollment until a factor is on file. Backup codes cover a lost device.
Rate limiting and abuse protection
Login, signup, and public form endpoints are rate-limited per client, backed by Cloudflare's network-level protections against automated attacks.
Nightly encrypted backups
The production database is dumped nightly to isolated object storage with 30-day retention, so a bad day never costs more than a day of data.
Least-privilege credentials, rotated on schedule
Service credentials are scoped to the single service that needs them and rotated on a regular cadence. Payment data is handled entirely by Stripe — full card numbers never touch our systems.
AI review without training exposure
Documents reviewed by AI (safety programs, training certificates) are processed via Anthropic's API, which does not use customer API data to train models.
Certification roadmap, stated plainly
SOC 2 Type I, then Type II, then ISO 27001:2022 are planned, in that order. A first third-party penetration test is planned. We hold none of these today; we say so plainly rather than implying certifications we don't yet hold, and we will publish dates once an auditor is engaged.
Found a vulnerability?
Report it to security@idoneity-cms.com. We acknowledge reports within 2 business days, and we don’t pursue good-faith researchers. Please don’t access data that isn’t yours or degrade the service while testing.