Security Policy

At JobStep, we take the protection of customer data extremely seriously. This Security Policy describes the organizational and technical measures JobStep implements platform-wide, designed to prevent unauthorized access, use, alteration, or disclosure of customer data.

Overview

JobStep services operate on Amazon Web Services (AWS), Cloudflare R2, Railway and Vercel. As you continue to learn more about JobStep, we recommend you also review our Terms of Service and Privacy Policy.

Security Team

Our team includes people who have played lead roles in designing, building, and operating highly secure Internet-facing systems at companies ranging from startups to large public companies including Tesla, AWS, and BMW.

Best Practices

Incident Response Plan

• We have implemented a formal procedure for security events and have educated all our staff on our policies.
• When security events are detected they are escalated, and our team is notified and assembled to rapidly address the event.
• After a security event is fixed we write up a post-mortem analysis.
• The analysis is reviewed in person, distributed across the company and includes action items that will make the detection and prevention of a similar event easier in the future.

Build Process Automation

• We have functioning, frequently used automation in place so that we can safely and reliably rollout changes to both our application and operating platform within minutes.
• We typically deploy code many times a day, so we have high confidence that we can get a security fix out quickly when required.

Authentication

• We have two-factor authentication (2FA) and strong password policies on GitHub, AWS, Cloudflare, and Vercel to ensure access to cloud services is protected.
• User authentication is handled through Firebase Authentication with support for email/password and OAuth providers (Google, Apple).

Infrastructure

• All of our services run in the cloud. JobStep does not run our own routers, load balancers, DNS servers, or physical servers.
• We have services and data hosted in Railway facilities and protected by Railway security.
• We have services hosted on Vercel and protected by Vercel security.
• We use Cloudflare R2 for object storage with enterprise-grade security.

Application Monitoring

• We use Sentry for application monitoring to quickly identify and resolve incidents.
• All access to JobStep applications is logged.
• Actions taken on production consoles or in the JobStep application are logged.

Data

• JobStep data is primarily hosted in Railway and AWS facilities in Europe.
• Customer data is stored in PostgreSQL databases with strict access controls.
• Customer documents and media files are stored in Cloudflare R2 with encryption at rest.
• Each JobStep system used to process customer data is adequately configured and patched using commercially-reasonable methods according to industry-recognized system-hardening standards.
• JobStep engages certain subprocessors (AWS, Railway, Cloudflare, Vercel, OpenAI) to process customer data.

Data Transfer

• JobStep is served 100% over HTTPS.
• All data sent to or from JobStep is encrypted in transit using TLS 1.3 with 256-bit encryption.
• Our API and application endpoints are TLS/SSL only.
• We encrypt all sensitive data using an industry-standard AES-256 encryption algorithm.

Payment Processing

All payment instrument processing for the purchase of JobStep services is performed by Stripe, a PCI DSS Level 1 certified payment processor. JobStep does not store or process credit card information directly.

AI Model Processing

We utilize OpenAI's GPT models and Anthropic's Claude models for AI-powered features. Customer data sent to these services is:

• Transmitted over encrypted connections
• Not used to train AI models (per our agreements with AI providers)
• Subject to the privacy and security policies of these providers
• Processed in compliance with GDPR and other data protection regulations

Customer Responsibilities

• Managing your own user account and organizations on JobStep.
• Protecting your own account and user credentials by securing your email when accessing JobStep services.
• Compliance with the terms of services agreement with JobStep, including with respect to compliance with laws.
• Promptly notify JobStep if a user credential has been compromised or if you suspect possible suspicious activities that could negatively impact the security of JobStep services or your account.
• You may not perform any security penetration tests or security assessment activities without the express advance written consent of JobStep.

Compliance

JobStep is committed to maintaining compliance with relevant security and privacy standards:

• GDPR (General Data Protection Regulation) compliant
• Working towards SOC 2 Type II certification
• Swiss data protection regulations compliant

Security Updates

We continuously monitor and update our security measures. For the latest information about our security practices, please contact us at security@jobstep.io.

Contact Information

For security-related inquiries or to report a security vulnerability, please contact:

TenThirty GmbH
Guggachstrasse 6
8057 Zürich, Switzerland
Email: info@jobstep.io