Aureo Job Security Policy
This policy describes the technical and organizational safeguards Aureo Technologies uses to protect Aureo Job. It is intended to explain our controls clearly; it does not by itself represent a security certification.
Scope
This policy covers the Aureo Job application, its public pages, support services, internal administrative tools, and the infrastructure controlled by Aureo Technologies to operate the product.
Shared responsibility
Aureo Technologies protects the platform and its infrastructure. Each customer company manages its users, roles, devices, uploaded data, consents, and operational decisions. Customers should grant the minimum access required and remove access when a person no longer needs it.
Identity and access
Passwords are stored using one-way cryptographic functions, not as readable text. Public registration requires email verification before an account is created. Password-reset links are stored as hashes, expire, and can be used only once. Sign-in attempts are rate limited, with a temporary account lock after repeated failures. Permissions are enforced by role and can be adjusted for individual users. Privileged internal Aureo Technologies administration requires two-factor authentication.
Sessions and web security
In production, Aureo Job uses HTTPS and session cookies with Secure, HttpOnly, and SameSite attributes. Protected forms and actions use CSRF defenses. Sensitive responses are marked against caching, and a Content Security Policy restricts unauthorized script execution. Protected routes require authentication and authorization.
Company isolation
Operational records are associated with a company through company_id. Query scoping, permissions, and ownership checks restrict access to the authenticated company. Authorization checks also apply when resources are requested by identifier to reduce the risk of improper direct access.
Files and evidence
Uploads have size limits and checks for safe names, extensions, and allowed types. Images are normalized before storage. Private evidence is stored outside public assets and delivered through authorized routes; private responses are served without caching where appropriate.
Secrets and integrations
Infrastructure and provider credentials are kept outside the repository and public files. Passwords, verification tokens, access links, and OAuth states are hashed or otherwise protected according to their purpose. Integration access is limited to authorized users.
Payments
Stripe processes card data and subscription transactions. Aureo Job retains the references and statuses required for operations but does not store full card numbers.
Audit and monitoring
Sensitive actions record, as applicable, the user, company, date, IP address, user agent, resource, and non-secret metadata. Primary audit events are linked with hashes to support integrity reviews. The platform maintains operational logs, health checks, and error review to detect failures.
Backups and recovery
The database backup process creates copies with restricted permissions and validates that each file can be read by the restore tool. Aureo Technologies maintains recovery procedures and periodically reviews backup freshness and restore testing.
Change and vulnerability management
Changes undergo functional and security testing proportionate to risk before deployment. Dependencies and configurations are reviewed during service maintenance. Confirmed findings are prioritized according to impact and likelihood of exploitation.
Incident response
Security events are recorded, classified, investigated, and contained. When an incident affects a customer's data or services, Aureo Technologies evaluates scope, preserves evidence, and provides communications required by contract or applicable law. Reports may be sent to [email protected].
Data, retention, and deletion
Data processing, retention, export, and deletion are governed by the Privacy Policy, DPA, valid customer instructions, and applicable obligations. Privacy requests may be sent to [email protected].
Policy review
No system can guarantee absolute security. Aureo Technologies reviews this policy at least annually and when a material change affects Aureo Job controls or operations.