Security

• The Service runs on Microsoft Azure in the Sweden Central region. Data, files and backups are stored in Sweden.
• The database only accepts encrypted connections from the Azure services that run the application.
• Uploaded files are kept in private storage and opened through links that expire after 30 minutes.

• All traffic uses HTTPS (TLS 1.2 or newer), and browsers are told to always use HTTPS (HSTS).
• The database, file storage and backups are encrypted at rest (AES-256).
• Passwords are never stored; we store only a salted bcrypt hash.

• Every request is tied to one organisation, and the server checks that the user is a member of it before returning any data.
• Within an organisation, roles control who can see and change what.
• Important changes are recorded in an audit trail.

• Sessions use a cookie that scripts cannot read (HttpOnly), that is only sent over HTTPS (Secure) and that expires after 7 days.
• Repeated failed sign-in attempts are rate-limited.
• A strict Content Security Policy and other security headers protect against cross-site scripting, clickjacking and similar attacks.

Matching consultants to assignments runs on our own servers with an open-source language model. Uploaded CVs are read by an AI model (Azure OpenAI) in our own Azure account in Sweden, reached over a private network and signed in to with the service's own identity rather than a key. Your data is not sent to any external AI provider, is not stored by the model, and is not used to train any model.

• The database is backed up automatically and can be restored to any point in the last 14 days.
• The application is monitored with health checks, and the platform restarts it automatically if it crashes.

• Every change is tested automatically before it is deployed.
• Deployment uses short-lived, federated credentials; no long-lived passwords for the production environment are stored in our code or build system.
• Dependencies are checked for known vulnerabilities and kept up to date.
• Access to production is limited to the operator of the Service and protected with multi-factor authentication.

If you find a security issue, please tell us at kontakt@obsidius.se before making it public, and give us reasonable time to fix it. Do not access or change other people's data while testing. We are grateful for responsible reports.