Security & Trust
Last updated: 2026-05-01
NP Hiring (operated by Akari Labs LLC) handles personal information that matters: resumes, contact details, and sometimes credentialing identifiers.
Encryption everywhere
Resume & file safety
Privacy by default
Analytics and advertising cookies default to denied and load only after the visitor explicitly accepts them. Vercel Speed Insights waits for the same consent. Visitors from the EEA, UK, Switzerland, Canada, Brazil, and Australia see a strict opt-in banner. Visitors in implied-consent regions keep one-click control through the "Cookie Settings" link in the footer and the Do Not Sell or Share page.
We honor the Global Privacy Control (Sec-GPC) and Do Not Track (DNT) browser signals as a binding opt-out: no banner appears and no analytics fire.
Authentication & access
Authentication is handled by Supabase Auth. Session cookies are HttpOnly, Secure, and SameSite=Lax. Password resets are rate-limited to 3 requests per hour per IP and respond identically whether or not the email is registered, so attackers cannot enumerate accounts.
Account deletion is a soft delete with a 30-day grace window, so accidental deletions are reversible. After the grace period, a daily cron job hard-purges the record and the matching Supabase Auth identity. Inactive accounts that have not logged in for 23 months receive a warning email and are then soft-deleted. The total dormancy lifecycle to hard deletion is approximately 25 months.
Incident response
Every sensitive action (account deletion, data export, role change, DSAR receipt, soft-delete purge) is recorded in an append-only audit log. We operate a written incident-response runbook with a 72-hour notification commitment that aligns with GDPR Art. 33: privacy regulators are notified, affected users receive a plain-language email, and a post-incident review is published within 30 days.
If you notice something suspicious, email security@nphiring.com. We acknowledge reports within one business day.
Compliance posture
| Framework | Status |
|---|---|
| GDPR / UK GDPR | Aligned. A DPIA is on file. See the Privacy Policy, §11 to §16. |
| CCPA / CPRA | Aligned. Opt-out endpoint provided and GPC honored. |
| PCI-DSS | SAQ-A. Card data is captured by Stripe Checkout and is never stored on our infrastructure. |
| SOC 2 | In progress. A Type 1 attestation is planned when our first enterprise customer requires it. Most controls are already in place. See the audit summary below. |
| HIPAA | Not applicable. We do not process Protected Health Information. Job seekers may voluntarily disclose health-related items in resumes. That content is not parsed for clinical data. |
| CASL / PIPEDA / LGPD | Strict opt-in for marketing email. Double opt-in on job alerts. Sub-processors disclosed. |
Documents we publish
- Privacy Policy: what we collect, why we collect it, and how long we retain it.
- Sub-processors: every vendor, with DPA and privacy policy links.
- Data Request: file access, deletion, or correction requests.
- Do Not Sell or Share: the CCPA / CPRA one-click opt-out.
- Terms of Service.
Internal documents we will share with enterprise prospects on request: the incident-response runbook, the DPIA, and the 25-gap compliance audit with closure evidence.
Reporting a vulnerability
If you believe you have found a security vulnerability, please email security@nphiring.com with reproduction steps and any affected URLs. We commit to the following:
- Acknowledge receipt within one business day.
- Provide a triage update within five business days.
- Not pursue legal action against good-faith researchers who follow these guidelines.
- Credit you publicly (if you wish) once the issue is resolved.
Please do not exfiltrate data, run automated denial-of-service tests, or test against accounts that are not yours. We do not currently run a paid bug bounty program. We acknowledge contributions in writing.