Security Posture

How FindMyJob protects your account and data — described factually, with no blanket safety claims.

Last reviewed: September 2026. This page describes our current implementation; it is not a certification or legal commitment.

Accounts & authentication

Sign-in (email/password and social providers) is handled by the Base44 identity platform — we never store your password.

Every account has a role (job seeker, employer, admin), and protected pages reject signed-out visitors on the server side, not just in the interface.

Your responsibilities: use a strong, unique password, and don't share your account. Sign out on shared computers.

Data isolation

Records like profiles, messages, applications, saved searches, and billing history are access-controlled at the database level: you can only read and change your own records.

Job listings and company profiles are public by design; personal contact details (such as your mailing address) are kept private and are not shown on any public page.

Administrators can see site-wide counts and records needed for support, safety, and legal compliance — access is limited to the admin role and enforced server-side.

Payments

All payments run through Stripe Checkout — card details never touch our servers.

Purchases are fulfilled only after the payment is re-verified with Stripe server-side; the app never grants paid features based on client-side claims.

Payment webhooks are verified with a cryptographic signature before being accepted, and duplicate deliveries are ignored.

Operations

A daily automated health check records a site heartbeat, and an automated job expires stale listings.

Backend functions that call external services validate their inputs and limit how much any single request can do.

Platform-level encryption at rest and in transit is provided by our hosting platform; we rely on it and have not independently audited it.

What we don't do

We don't sell your personal data, and we don't run third-party ad trackers.

We don't claim the site is "unhackable" or risk-free — no web service is. If you believe you've found a security issue, please tell us responsibly via the contact page.