Trust & Data Posture
How we handle your data, who else sees it, and what we deliberately do not claim. We list the controls we actually operate and the certifications we do not (yet) hold. If anything below changes, this page is the source of truth.
Controls we operate today
Encryption in transit
TLS 1.2+ on every request to every endpoint. HSTS on the marketing surface. No fallback to plaintext.
Encryption at rest
Application database encrypted at rest via Supabase managed Postgres on AWS KMS. Backups carry the same encryption.
Row-level security
Every multi-tenant table carries an RLS policy enforced at the database layer. An application bug cannot leak data across tenancies because the database itself refuses the cross-tenant read.
Least-privilege admin
Admin access to production is restricted to two named individuals and is logged. Day-to-day operations run as a service role that cannot read raw assessment answers.
Signed sub-processor agreements
Every sub-processor is under a signed agreement carrying the same data-protection terms we offer our customers. The list updates as sub-processors change; institutional customers get notice.
Candidate answer privacy
Raw item-level answers are never readable by any administrator in any tier — only by the user who created them and by the scoring engine. Aggregate metrics for coordinators are computed from scored outputs, not raw inputs.
What we will not do
We do not sell data.
Not now, not to anyone, not for any price. Not assessment data, not contact data, not cohort data. If we ever change this, it will be an explicit opt-in change visible here.
We do not train AI models on customer data.
The AI-generated content surfaces call third-party LLMs at request time without contributing the user's assessment data to those models' training corpora.
We do not claim certifications we have not earned.
No SOC 2 badge unless we are certified. No ISO 27001 mention unless we hold it. No HIPAA claim unless we are operating as a business associate under a BAA.
We do not surface raw answers to admins.
Coordinators see aggregate cohort metrics and consented summaries. Item-level answers stay with the candidate and the scoring engine.
Sub-processors
These five third-party services process customer data on our behalf. Each is under a signed agreement carrying data-protection terms equivalent to the ones we offer our own customers. The list is updated when sub-processors change; institutional customers get notice in advance.
| Sub-processor | Purpose | Residency |
|---|---|---|
| Supabase | Managed Postgres, authentication, file storage | EU (Frankfurt) default; US on request |
| Vercel | Application hosting, edge cache, CDN | Global |
| Stripe | Payment processing | Per Stripe terms; assessment data never sent |
| Google (Gemini API) | LLM inference for AI-generated content surfaces | Per Google terms; anonymized prompts only |
| Cloudflare | DNS, edge security, web analytics | Global edge |
Data residency
The default region for new tenants is the European Union (Frankfurt). U.S. data residency is available on request for institutional and enterprise customers — written into the DPA. We do not currently offer dedicated single-tenant infrastructure; the multi-tenant database is partitioned with row-level security policies that enforce isolation at the database layer.
Data Processing Agreement
A standard DPA covering GDPR Article 28 processor obligations is available on request and is included by default with Team, Scale, and Enterprise tiers. The DPA includes the sub-processor list, the security controls listed above, the data-export and deletion mechanics, and the notification terms for sub-processor changes and security incidents. Email hello@jobcannon.io and we send a copy for review the same business day.
Security incident response
We follow the GDPR Article 33 notification window: any incident affecting customer data is reported to the listed billing contact on the affected organization within 72 hours of confirmation, with a post-incident report (root cause, scope, remediation, prevention) within 30 days. We have not had an incident requiring such notification to date; if and when one occurs, we will say so here, with the date, and link the post-incident report.
What we do not yet have, said plainly
We are not SOC 2 Type II certified. We are not ISO 27001 certified. We do not hold HIPAA business-associate status. We do not operate a public bug bounty programme. We do not currently offer single-tenant dedicated infrastructure. Each of these is a real gap; some are on the roadmap and some are not. If a specific control is a hard requirement for your procurement, contact us and we will tell you honestly whether we can meet it now, when we will be able to, or that we will not pursue it.
FERPA, COPPA, and school deployments
U.S. school and district deployments operate under a school-official posture consistent with FERPA, with a written agreement covering the data the school district designates as student records. For under-13 access (COPPA), institutional deployments use either verifiable parental consent or school-authorized consent; the consumer product does not collect data from users under 13. Two guides walk administrators through the exact posture — the FERPA guide and the COPPA guide.
Contact
For privacy or data-protection questions, security disclosures, or DPA requests, email hello@jobcannon.io. For specific procurement-team requirements, include the question in plain language and we will reply within one business day with whether we can meet it.
No. We will not claim a certification we have not earned. SOC 2 Type II is on our roadmap and we will publish the date the day the audit completes. Until then, the controls we already operate (encryption in transit and at rest, row-level security, least-privilege admin access, signed sub-processor agreements) are listed below in plain language, with no badge attached to them.
Yes, in the substantive sense that matters: every JobCannon user has the right to export their data, the right to deletion, and the right to a copy of any record we hold about them. We act on those requests within the GDPR-mandated 30-day window. A formal Data Processing Agreement (DPA) is available on request for institutional and enterprise customers — contact hello@jobcannon.io. We do not display a GDPR badge because no enforcement body issues one; we display the underlying controls instead.
Application data — accounts, assessment results, organizational tenancy — is stored in Supabase's managed Postgres on AWS infrastructure. The default region is EU (Frankfurt) for new tenants. US data residency is available on request for institutional and enterprise customers. Static assets and edge cache live on Vercel's global network. Payment data never touches our servers — it goes directly to Stripe.
Five primary sub-processors. (1) Supabase — managed Postgres, authentication, file storage; data residency configurable. (2) Vercel — application hosting and edge cache; global CDN. (3) Stripe — payment processing; sees billing data, never assessment data. (4) Google (Gemini API) — large-language-model inference for AI-generated content surfaces; we send anonymized prompt content, not raw user assessment data. (5) Cloudflare — DNS, edge security, and analytics. The full sub-processor list and the version log of changes is in our DPA, available on request.
No — by deliberate design. In institutional deployments, coordinators see aggregate cohort metrics (archetype distribution, completion rates, skill-gap rollups) by default. Individual candidate summaries (archetype label, top career matches) are visible to coordinators only when the candidate explicitly consents during the assessment. Raw item-level answers are never exposed to any administrator in any tier — they exist only in the scoring engine. This is enforced at the database layer with row-level security policies, not at the application layer where a bug could leak.
No. We do not train any model on customer assessment data, organization data, or cohort data. The AI-generated content surfaces in the product (premium narratives, career-explanation engine, coach-style framing) call third-party LLMs at request time and do not contribute the user's data to those models' training corpora — Gemini API is configured with the standard commercial-use posture, which excludes training-data use of prompts.
A candidate deletion request removes the user record, the assessment results, the answers, and the user's presence in any cohort within 30 days. Aggregate cohort metrics that depended on that user's presence remain (the rollup numbers do not retroactively change), but the user-level data is gone. An organization deletion removes the org tenancy, all cohorts under it, and all org-scoped data within the same window. Backups carry a 30-day retention; data in backups is excluded from new restores but cannot be selectively erased from existing backups — standard practice.
For U.S. K-12 partners, JobCannon operates under a school-official posture consistent with FERPA: institutional deployments restrict who sees what student data, sign a written agreement with the school district, and provide deletion on request. For under-13 access (COPPA), institutional deployments operate under verifiable-parental-consent or school-authorized-consent paths; the consumer product does not collect data from users under 13. Our guides on /b2b/guides/ferpa-student-data-career-platform and /b2b/guides/coppa-compliance-career-assessment-under-13 walk school administrators through the exact posture.
Notification within 72 hours for any incident affecting customer data, consistent with GDPR Article 33. Notification goes to the listed billing contact on the affected organization and, where required, to the relevant supervisory authority. A post-incident report (root cause, scope, remediation, prevention) is published within 30 days to the affected customer. We have not had an incident requiring such notification to date; if and when one occurs, we will say so on this page.
Yes — included by default for institutional (Team, Scale) and enterprise customers. The DPA covers GDPR Article 28 processor obligations, sub-processor list and notification of changes, data-export and deletion mechanics, and the security controls list. Contact hello@jobcannon.io and we send a copy for review the same business day.