Security Policy

1. Infrastructure Security

Hosting: Worktrak Recruit is hosted on dedicated Linux servers in India with restricted network access. All servers are kept up to date with security patches.

Network: Traffic to Worktrak Recruit is served exclusively over HTTPS (TLS 1.2+). HTTP requests are automatically redirected to HTTPS. Our servers are protected by firewall rules that restrict access to only necessary ports and services.

Web server: We use Nginx as our reverse proxy, configured with security headers including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security (HSTS).

2. Application Security

• Authentication: Passwords are hashed using bcrypt with appropriate cost factor. Password reset tokens are cryptographically random and time-limited.
• Session management: Sessions use secure, HttpOnly, SameSite cookies. Session identifiers are regenerated on login.
• CSRF protection: All state-changing requests are protected by synchronised CSRF tokens.
• SQL injection prevention: All database queries use PDO prepared statements with parameterised inputs. Raw SQL string concatenation is prohibited.
• Input validation: All user input is validated server-side. Output is HTML-escaped before rendering.
• Multi-tenancy isolation: All data operations are scoped to the authenticated tenant. Tenant identifiers from user input are never trusted; they are always resolved from the authenticated session.
• File uploads: Uploaded files (resumes, documents) are stored outside the web root and served through controlled download endpoints, not directly accessible via URL.

3. Access Control

Worktrak Recruit implements role-based access control (RBAC). Access to candidate data, job postings, and administrative functions is restricted based on the user's role (Administrator, Recruiter, Hiring Manager). Super-admin access to tenant data is available only to authorised Worktrak staff and only when necessary to provide support.

4. Data Encryption

All data in transit is encrypted using TLS. Database backups are encrypted at rest. Passwords and sensitive credentials are never stored in plaintext.

5. Backups and Recovery

Database backups are performed regularly. Backups are stored securely and tested periodically to verify data integrity and recovery capability. In the event of data loss, we will make every reasonable effort to restore data from the most recent backup and notify affected customers promptly.

6. Monitoring and Incident Response

We monitor application logs and server metrics for anomalous activity. In the event of a confirmed security incident:

• We will investigate and contain the incident as quickly as possible.
• Affected customers will be notified within 72 hours of becoming aware of a breach that affects their data.
• We will provide information on the nature of the incident, data affected, and steps taken or recommended.

7. Third-Party Dependencies

We minimise third-party dependencies and review them for security. Frontend libraries (Bootstrap) are loaded from trusted CDN providers. We monitor for known vulnerabilities in our dependencies and update them promptly when security patches are released.

8. Responsible Disclosure

If you discover a security vulnerability in Worktrak Recruit, we ask that you report it responsibly before making it public. Please email us at security@worktrak.in with:

• A description of the vulnerability and its potential impact.
• Steps to reproduce the issue.
• Any relevant screenshots or proof-of-concept code.

We commit to acknowledging your report within 2 business days, keeping you informed of our progress, and — where the vulnerability is new and significant — recognising your contribution on this page (with your permission).

Please do not access, modify, or delete data that is not yours, and do not perform actions that could disrupt the service for other users.

9. Security Contact

For security concerns or vulnerability reports: security@worktrak.in

For general support: support@worktrak.in