Loading…
What Offerrole does to protect candidate and employer data today — stated plainly, so your IT, Legal or Compliance review can check it. Questions we don't answer here, ask us.
Every page and API call is served over HTTPS. Tax forms, payout details, authenticator-app secrets and cards saved for renewals are also encrypted field by field with AES-256-GCM before they are stored.
Passwords are stored only as bcrypt hashes. Two-step sign-in — a code by e-mail or an authenticator app — is required for every account created since it launched, and any account can turn it on.
Roles decide who can open what. In the talent network, candidates’ names and e-mails stay masked until a recruiter records why they need them.
Administrative and security actions — sign-in settings, unmasking a candidate, payouts, account changes — are written to an audit log that the database itself won’t let anyone edit or delete.
Every consent a candidate gives or withdraws is recorded in a ledger the database won’t let anyone edit or delete, with the wording they saw and when.
Candidates can copy, correct or delete their data at /data-access. We honour Global Privacy Control signals and your cookie choices.
They are listed by name in our privacy policy and in Annex III of the data processing agreement.
Not yet — no independent audit has been completed. When one is, its report will be listed on this page. Until then we answer security questionnaires directly.
Yes. The data processing agreement is published at /legal/dpa; we are the processor and you are the controller.
Write to support@offerrole.com with "Security" in the subject. Please don't include candidate data in the message.
Send us your security questionnaire and we will answer it in writing.