Security

Accounts and sign-in

• Sign-in is by a link or code sent to your email; there is no password to steal or reuse.
• A second lock is mandatory for everyone who opens the suite: a passkey (Face ID, Touch ID, a security key) or an authenticator code. The same lock findjobs employers already use.
• Sessions expire after thirty days of silence and can be ended from any device.
• Every teammate has their own sign-in and their own second lock; nobody shares an account.

Roles

Owner, HR admin, manager, recruiter, accountant and employee each see only what their job needs. A manager sees their own team's pay, never another team's; a recruiter sees applicants, never records; an accountant sees pay and files, never interview notes.

Documents and private details

• Contracts, ID copies and bank details are stored encrypted with AES-256-GCM, the way findjobs stores CVs today. The key lives on the server and never in a browser.
• Every view of a personal number, a bank account or a salary is written to an access log with who and when. The owner sees it; nobody can edit or clear it.

Infrastructure

• The suite runs on Cloudflare Workers; the database sits in Frankfurt.
• Every connection is encrypted in transit.
• A watchdog checks the site every few minutes and pages the owner on a fault.
• Nothing is deleted: leavers and closed companies are archived.

Coming

• Sign-in alerts: an email when your account is opened from a new device or country.
• A list of your active sessions with sign-out everywhere.
• A data processing agreement page for companies.
• Support access only when the owner grants it, time-limited and logged.

Reporting a problem

Write to info@findjobs.ge. We answer security reports first.