Security & Compliance Statement

1. Hosting and service boundaries

JobTek applications, databases, files, backups, monitoring and data-protection keys are hosted using Microsoft Azure services, principally in UK or European regions. Cloudflare supports custom-domain certificate management, traffic protection and Turnstile verification. Approved providers may process limited data in other locations under the transfer safeguards described in the Data Processing Addendum.

2. Identity and access

• Role-based permissions and least-privilege access for customer and administrative functions.
• Multi-factor authentication for privileged administrative access and support for customer identity controls.
• Controlled onboarding, access review, offboarding and audited administrative activity.
• Shared authentication cookies use browser security controls that restrict script access, require secure connections and limit cross-site use in production.

3. Encryption and secrets

• Transport Layer Security (TLS) 1.2 or later protects public endpoints, and HTTP Strict Transport Security (HSTS) is enabled across production web properties.
• Azure-managed encryption at rest for databases, storage and backups where applicable.
• Application secrets and data-protection keys are held in protected configuration and managed storage rather than exposed to users.

4. Application security

• Secure development, peer review, automated tests, dependency management and code analysis.
• Anti-forgery protection, content-security controls, input validation and permission checks appropriate to each endpoint.
• Staged release and health verification for production web releases.
• Vulnerability review and remediation according to severity.

5. Monitoring, audit and incident response

• Application and infrastructure telemetry through Azure monitoring services.
• Security, sign-in, configuration and important business activity logs appropriate to the feature.
• Documented investigation, containment, recovery and post-incident review.
• Customer breach notification without undue delay and within 48 hours of awareness where the Data Processing Addendum applies.

6. Communications and integrations

Email is processed through Twilio SendGrid. JobTek-managed domains use controls that help prevent sender impersonation and protect message integrity, including SPF, DKIM and DMARC, with TLS encryption where supported. Mobile notifications use Apple Push Notification Service and Google Firebase Cloud Messaging. Payment, accounting, Meta, mapping, DVLA and AI providers receive only the information needed for an enabled or invoked connection, as described in the Privacy Policy.

7. Backups and continuity

JobTek performs regular production backups and restoration testing. The Service Level Agreement contains availability and support targets. Recovery time depends on the nature and scale of an incident; the non-contractual recovery point objective is up to 24 hours unless otherwise agreed.

8. Mobile and browser data

The mobile app uses secure platform storage for authentication material and a local database for offline access. Organisations should protect managed devices, apply operating-system updates and remove access from lost or retired devices. Browser cookies and local storage are described in the Cookies Policy.

9. Supplier assurance

JobTek reviews providers according to the service and risk involved, uses written data-protection and security terms where required, restricts access and monitors material changes. Core providers and the connections customers can enable are listed in the Privacy Policy and Data Processing Addendum.

10. Compliance

JobTek is Cyber Essentials certified. Its wider security programme is designed to support UK GDPR and Data Protection Act 2018 obligations and is informed by National Cyber Security Centre guidance and ISO/IEC 27001 controls. The current Cyber Essentials certificate is available at https://registry.blockmarktech.com/certificates/a3f2ddf7-7c59-469e-80ab-f35e64d716ca/?source=WEB.

11. Responsible disclosure

Report a suspected vulnerability or security incident to security@jobtek.com. Include a clear description and safe reproduction information. Do not access another person's data, disrupt service, use destructive testing or publicly disclose an unresolved issue. JobTek will acknowledge and triage responsible reports.

12. Customer responsibilities

• Use strong, unique credentials and multi-factor authentication where available.
• Assign permissions carefully and remove access promptly.
• Protect devices, exports and integration credentials.
• Maintain lawful instructions, suitable privacy information and appropriate retention for customer-controlled data.

Contact

Security: security@jobtek.com

General enquiries: info@jobtek.com

Post: JobTek Ltd, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom.

For related information, see the Privacy Policy, Cookies Policy, Acceptable Use Policy, Data Processing Addendum and Service Level Agreement.