TrustCentre
Transparent security practices and certifications about how we secure, store and safeguard your recruitment data.
Data stays encrypted, isolated and access-controlled
Data protection follows every record from first upload through storage, processing and backup.
Encrypted in transit and at rest
Protect every record with AES-256 encryption at rest and TLS 1.3 in transit, while resumes and cover letters sit in encrypted storage built for 11 nines of durability.
No payment data on our servers
Pay through Stripe for subscriptions or GoCardless for Direct Debit, both PCI DSS compliant, so JobAdder never stores credit card details or other sensitive payment data.
Dummy data in sandbox accounts
Sandbox accounts use dummy data, never real candidate or client records. For production-like testing with your own data, request a dedicated UAT environment.
Authenticated access for everyone who enters your account
Set sign-in rules, user permissions and when our support team can view your account.
MFA, passkeys and SSO
Enforce multi-factor authentication, offer passkey login, or connect your own identity provider via SAML or OIDC; supporting Azure AD, Google Workspace, ADFS, and more.
Permissions built around real roles
Set granular, function-level permissions with role-based access control, from exporting data or granting API access, so users can only action what their role requires.
Grant our support team access
Our support team has no standing access to your data or your account. Grant access only when you choose, for a fixed window from 3 days up to 8 weeks.
Built for maximum uptime, designed to contain failure
Regional redundancy, automated failover and staged rollouts keep JobAdder running when something goes wrong.
99.99% average uptime in 2025
Check real-time status, incident history and maintenance schedules on our public page, status.jobadder.com, so you never have to wait for us to tell you something’s wrong.
11 data clusters across 4 regions
Your data is logically isolated by tenant and physically distributed across regions, so a failure in one cluster or region doesn’t cascade into a platform-wide outage.
15-minute backups, 2-hour recovery
Backups run weekly, nightly and every 15 minutes, so in a worst-case scenario you’d lose no more than 15 minutes of data and be back up within two hours.
Privacy controls that protect your candidates and clients
Built-in consent, candidate self-service and clean deletion help you meet your GDPR obligations.
Consent built into application forms
Add GDPR-compliant opt-in to job application forms with customisable privacy text, while candidates stay pending until their consent requirements are actually met.
Candidates manage their own data
Let candidates access, update or request deletion of their data through the Candidate Portal, so subject access requests are handled without extra admin.
Data deletion when you leave
Export your data before you leave if you need it. Once you cancel, it’s irretrievably deleted after 90 days, with all backups removed two weeks after that.
Independently tested and continuously scanned codebase
Every release is checked before it ships, and outside researchers can report anything we miss.
Annual penetration testing
JobAdder is tested by CREST-certified penetration testers every year and after any significant architectural change, with full results available to you under NDA on request.
Security checked before code ships
Every code change passes two-person review, static and composition analysis, and dynamic scanning against the OWASP Top 10 before it reaches the live platform.
Responsible vulnerability disclosure
Report anything you find through our vulnerability disclosure program, a clear and safe route for security researchers, and JobAdder acts on every report it receives.
Learn more about JobAdder trust and security
Is JobAdder ISO 27001 certified?
Yes, JobAdder is ISO 27001:2022 certified, with annual CREST-certified penetration testing and continuous vulnerability scanning built into every release.
Where is JobAdder hosted, and is my data isolated from other customers?
JobAdder is hosted on AWS across multiple regions and availability zones, with your data logically isolated by tenant so an issue in one account never touches another.
How does JobAdder support GDPR compliance?
JobAdder acts as the data processor while you remain the controller. Built-in consent capture, a self-service candidate portal for access and deletion requests, and irretrievable data deletion 90 days after account cancellation help you meet your obligations.
What happens if there's a security incident or outage?
Automated failover across multiple regions and availability zones keeps disruption contained, and real-time status, incident history and maintenance schedules are always public at status.jobadder.com. In a worst-case scenario, the 15-minute recovery point and 2-hour recovery time limit how much data could be lost and how long you'd wait to be back up.
Can I report a security vulnerability?
Yes, JobAdder's responsible vulnerability disclosure programme gives security researchers a clear, safe way to report issues, and every report is acted on.
Real results from JobAdder customers
