Security at UCTalent

1. Overview

This page summarises how UCTalent Labs Company Limited ("UCTalent", "we") protects the data processed on uctalent.io, business.uctalent.io and our apps. We run an information security management system aligned with ISO/IEC 27001. This page supplements section 11 of our Privacy Policy.

2. Protecting data

• Encryption in transit: all traffic to our Services uses TLS.
• Encryption of sensitive fields: financial and ID data, such as bank accounts and national ID numbers used for referral payouts, is encrypted at the application level with AES-256-GCM.
• Card payments are handled on our payment partner's hosted page. We store only a token and the last four digits, never full card numbers.
• Before a CV is sent to an AI model, we remove direct identifiers such as name, email, phone number, address, photo and ID numbers. Your data is not used to train AI models.

3. Access control

• Passwordless sign-in: you sign in with Google or another supported provider, or with a one-time code sent to your email. Codes expire after 10 minutes and sign-in attempts are rate-limited.
• Workspace isolation: each Referral ATS workspace's data is kept separate from other workspaces.
• Role-based access inside a workspace. For example, interviewers see only the candidates assigned to them.
• Staff access follows the principle of least privilege, is reviewed regularly, and every staff member is bound by a confidentiality commitment.
• Production servers can be reached only through a private network with key-based authentication.

4. Operations

• Access and security events are logged. Security logs are kept for 12 months.
• Data is backed up regularly. Backups are kept for at most 90 days.
• Code changes are reviewed before release, and dependencies are kept up to date through automated update requests.
• Security fixes are applied by severity: critical issues within 7 days and high-severity issues within 30 days.
• Our platform is tested by an independent penetration tester at least once a year.

5. Incident response

We follow a documented incident response process. If a personal data breach occurs, we contain and remediate it, notify the competent authority within the period required by law, and notify affected people and customer companies as described in section 16 of our Privacy Policy.

6. Service providers

The providers that process data for us are listed on our Sub-processors page. Referral ATS customers can read our Data Processing Agreement.

7. Report a security issue

If you believe you have found a vulnerability or a security incident, please tell us right away. See how to report a security issue.