TransportHTTPS everywhere with HSTS; HTTP redirects permanently to HTTPS.
PasswordsStored only as salted hashes. At least 8 characters with letters, numbers and mixed case.
SessionsSign-in tokens expire after 30 days; expired ones are removed nightly.
Abuse limitsSign-in is rate limited per email and per IP; registration, password reset and the contact form are rate limited too.
AuthorisationEvery record is checked against the person asking. One company can never see another's bookings, employees, certificates or messages.
Public profileOnly a whitelist of fields is public. Phone number, earnings, payout details and internal notes never are. Contact details are shared with a client only once their request is accepted.
Private filesChat, mailbox and broadcast attachments are served only through short-lived signed links.
Inbound emailHTML in replies is sanitised before it is stored and again before it is shown.
PaymentsProcessed by Razorpay; card and bank details never reach TaleoCert.
Your dataNotification preferences, and account deletion requests, in Settings › Privacy & data.
BackupsDatabase and uploaded files are backed up nightly and kept for 14 days.
