Security

Last updated: 5 November 2026

At Skillozia, we understand that recruitment agencies entrust us with sensitive candidate and client data. Security is foundational to how we build, deploy, and operate the platform. This page outlines the measures we take to protect your data.

Encryption

• All data in transit is encrypted using TLS 1.2+ (HTTPS enforced).
• Passwords are hashed using bcrypt with industry-standard salt rounds.
• JWT tokens are cryptographically signed and expire automatically.

Access Control

• Role-based access control (RBAC) with 11 built-in roles, from agency owner to hiring manager.
• Granular permissions per role. Each role sees only what is relevant to its work.
• Multi-tenant isolation. Every query is scoped to your organization, so no tenant can see another's data.
• Optional two-step login (an emailed code or an authenticator app) for every kind of account.
• Automatic session expiration and refresh token rotation.

Infrastructure

• Hosted on Amazon Web Services (AWS) with managed database services.
• Application deployed in isolated containers on Amazon ECS (Fargate).
• Network-level security groups restrict access to only necessary ports and services.
• Environment variables and secrets are managed securely and never stored in code.

Monitoring & Audit

• Audit logging of key actions: sign-ins, candidate changes, exports and deletions.
• Structured application logging with severity levels for rapid incident investigation.
• Server errors are logged; error aggregation (Sentry) and email alerts for failed background jobs run when configured.
• API rate limiting to prevent abuse and denial-of-service attempts.

Data Protection

• Multi-tenant data isolation ensures no cross-tenant data leakage.
• Candidate data can be exported or deleted by authorized tenant administrators at any time.
• File uploads (resumes, logos) are stored with unique identifiers and access controls.
• Data export available in CSV, Excel, and PDF formats for portability.

Development Practices

• Dependencies regularly audited and updated to patch known vulnerabilities.
• Input validation and sanitization on all API endpoints using schema validation (Zod).
• Parameterized database queries to prevent SQL injection.
• Content Security Policy headers to mitigate XSS attacks.
• Code review and testing processes for all changes before deployment.

Incident Response

In the unlikely event of a security incident involving personal data, we are committed to:

• Investigating and containing the incident promptly.
• Notifying affected tenants within 72 hours of confirmed breach, in compliance with applicable data protection laws.
• Providing a detailed post-incident report including scope, impact, and remediation steps.
• Implementing measures to prevent recurrence.

Responsible Disclosure

If you discover a security vulnerability in Skillozia, we encourage responsible disclosure. Please report vulnerabilities to security@skillozia.com with a detailed description of the issue. We commit to acknowledging reports within 48 hours and will work with you to understand and address the vulnerability. We ask that you do not publicly disclose the issue until we have had an opportunity to investigate and remediate.

Operated by

Questiverse Learning LLP — also operating eutopiaschool.com and skillesta.com.

Contact: security@skillozia.com