Security: how we protect you

Whether you are looking for work or hiring, you trust us with your details: a CV, a phone number, a company's adverts and invoices. This page says, in plain words, what we do to protect them, what you can do yourself, and where to go if something looks wrong.

1. What we do

• No CV database. The safest data is data that is never collected in one searchable pile. Your CV goes to the employer you applied to, and to nobody else. It is not for sale and nobody can search for it. See how we handle CVs.
• Encrypted connections. Every page is served over HTTPS, and browsers are told to use nothing else (HSTS).
• Passwords we cannot read. Passwords are never stored. We keep only a salted PBKDF2-SHA256 hash at 600,000 iterations, so nobody here can see yours, and nobody can tell you what it is: we can only help you set a new one.
• Safer sign in cookies. Session cookies are HttpOnly, Secure and SameSite, which keeps them away from scripts and from forms on other websites.
• Protection in the browser. A content security policy limits what can run on our pages, and our pages cannot be framed inside somebody else's site.
• No advertising trackers. We do not load third party advertising or tracking scripts, so your browsing here is not sold or shared. See the cookie policy.
• Adverts are checked. Every advert is screened automatically, and anything reported is looked at by a person. See the online safety assessment.
• Limited, recorded staff access. Staff accounts have only the permissions their work needs, the admin panel supports two step sign in, and what staff do is recorded in an audit log.
• A breach process. If personal data were ever put at risk, we follow the process in our privacy notice, including telling the Information Commissioner's Office within 72 hours where the law requires it.

2. What you can do

• Use a password you use nowhere else. A password manager makes that easy.
• Sign out on a shared or public computer.
• Keep your email account secure, with two step verification: whoever controls your email can reset your password anywhere.
• Never put your National Insurance number, bank details, date of birth or passport number on a CV. No employer needs them to read it.
• If you think somebody else has used your account, change your password and tell us.

3. Scams and fake messages

Real employers do not ask you to pay for a job, a uniform, training or a DBS check up front, and we never ask for your password, your bank details or a payment from a jobseeker. How to check a message that claims to come from us or from an employer, and what to do if you have already given something away: spotting job scams.

4. Reporting

• An advert, an employer or a message that looks wrong: report it. A person reads every report.
• A weakness in the website itself: report a security problem. We reply within three working days and never take action against anybody who reports in good faith. Researchers can find the same contact in our security.txt.

No website can promise to be perfectly secure, and following these steps cannot guarantee it either. What we can promise is to take every report seriously and to tell you straight if something goes wrong.