Security at Jobin.cloud

Customers manage the information they submit to their Jobin.cloud workspaces and determine how they use the Services, subject to the applicable agreements and available controls.

Security and privacy are complementary responsibilities.

Jobin Cloud Limited acts as a data controller or data processor depending on the nature and purpose of the relevant processing activity.

Our approach to personal data processing is described in our legal documentation:

• Privacy Policy
• GDPR & Data Protection
• Terms and Conditions

These documents provide further information about data protection roles, retention, international transfers and individual rights.

Customer data is hosted within our infrastructure stored exclusively in data centres located within the European Union (EU).

This commitment applies to Customer data stored and managed within Jobin.cloud's hosting environment.

Our infrastructure is designed to provide secure, reliable storage and processing for recruitment records, professional contacts, communications and related business information.

Where Customers authorize third-party integrations or services, information may also be processed by those providers under their applicable arrangements and data protection safeguards.

For further information, refer to our Privacy Policy.

Jobin.cloud applies security controls to protect information during transmission, storage and account access.

Encrypted communications

Connections between users and Jobin.cloud are protected using HTTPS and Transport Layer Security (TLS), helping safeguard information transmitted over public networks.

Data encryption

Our hosted services use encryption mechanisms designed to protect stored information, alongside access controls and other safeguards appropriate to the underlying systems.

Password protection

User passwords are protected using cryptographic password hashing rather than being stored as readable plaintext.

Authentication and session management

Jobin.cloud uses authenticated sessions, signed tokens and server-side validation to help ensure requests originate from authorized users.

Authentication-related controls include mechanisms for validating credentials, protecting sensitive account actions and mitigating automated abuse.

Enterprise Cloud Infrastructure

Jobin.cloud's backend infrastructure is powered by Google Cloud Platform (GCP), providing a foundation for secure, scalable and resilient cloud operations.

Google Cloud maintains independently audited security and compliance programs, including certifications and reports under internationally recognized frameworks such as:

• ISO/IEC 27001 — Information security management.
• ISO/IEC 27017 — Security controls for cloud services.
• ISO/IEC 27018 — Protection of personal information in public clouds.
• SOC 1, SOC 2 and SOC 3 — Independent assurance and reporting frameworks.
• CSA STAR — Cloud security assurance.

These are Google Cloud certifications and attestations, applicable to services within their respective scopes

Google Cloud's physical infrastructure incorporates controlled facility access, monitoring and physical security measures.

Details of Google Cloud's certifications and applicable audit reports are available through its Compliance Resource Center.

Kubernetes and Layered Infrastructure Security

Jobin.cloud operates its backend services using Google Kubernetes Engine (GKE), Google's managed Kubernetes platform.

Kubernetes provides a foundation for deploying, managing and scaling containerized applications while separating services and supporting operational resilience.

Our architecture follows a layered security approach informed by the 4Cs of cloud-native security:

• Cloud: Infrastructure-level safeguards, controlled access to cloud resources and provider security capabilities.
• Clusters: Kubernetes configuration, workload management, service access controls and deployment management.
• Containers: Isolation of application workloads and management of containerized services.
• Code: Application security controls, authentication, authorization, testing and secure development practices.

This defense-in-depth approach provides multiple opportunities to prevent, detect and mitigate security issues rather than depending on a single protection mechanism.

Our production architecture also uses service health checks and automated scaling capabilities to support application availability as workloads change.

Access to Customer information is governed by authentication, authorization and workspace-level permissions.

Workspace and role-based access

Jobin.cloud supports user roles, workgroups and access permissions designed to restrict information and functionality to authorized users.

Permissions are enforced through application-level authorization mechanisms, with Customer and workgroup context used when accessing protected resources.

Restricted personnel access

Access to production infrastructure and Customer information is restricted to authorized Jobin Cloud personnel for legitimate support, maintenance, operational and security purposes.

Internal access is subject to applicable authorization and confidentiality requirements.

Operational controls

Our security practices include:

• Code reviews and required validation checks.
• Controlled production access.
• Application and infrastructure monitoring.
• Logging and error investigation.
• Maintenance and security updates.

These controls form part of our ongoing approach to maintaining the security and reliability of the Services.

Security is incorporated into Jobin.cloud's software development lifecycle.

Our development practices include code reviews, automated validation, application testing and the investigation and remediation of identified security issues.

We use established application-security guidance, including the OWASP Top 10, to inform security assessments and prioritize common web application risks.

Areas addressed through application-security practices include:

• Broken access control and unauthorized access.
• Security misconfiguration.
• Software supply-chain and dependency risks.
• Cryptographic and sensitive-data protection failures.
• Injection vulnerabilities.
• Insecure application design.
• Authentication and session-management failures.
• Software and data-integrity failures.
• Security logging and alerting deficiencies.
• Improper handling of errors and exceptional conditions.

Security reviews may also consider specific attack techniques, including cross-site scripting (XSS), cross-site request forgery (CSRF), injection attacks and authorization bypasses.

Our approach is to identify and mitigate vulnerabilities throughout development and maintenance rather than assuming that any application can be completely immune to security threats.

Jobin.cloud maintains operational safeguards intended to support service stability, incident investigation and recovery.

Application and infrastructure monitoring

We use application logging, error monitoring and infrastructure health checks to help identify operational issues and support timely investigation.

Reliability and scalability

Our Kubernetes infrastructure supports health-based workload management, service recovery and automated scaling according to operational requirements.

Backup and recovery

Our backup arrangements are designed to support recovery from data loss and operational incidents.

Our documented backup practices provide for daily backups, a 30-day retention period and regular recovery testing, subject to the applicable configuration and service arrangements.

These measures contribute to business continuity and resilience, although no infrastructure can guarantee uninterrupted availability or complete protection against every possible incident.

We understand that recruitment agencies and enterprise organizations may require additional information when assessing software providers.

For security, privacy or data protection inquiries, contact:

We maintain and review technical and organizational safeguards appropriate to the nature of our Services and the risks associated with processing personal data.