Security at ScensobConnect

Security isn't a checkbox — it's a posture. Here's what we do, and what we ask of you.

Encryption

• In transit: TLS 1.2+ everywhere. HSTS forced on production domain.
• At rest: AES-256 for sensitive fields (SSN, EIN, payment metadata). MongoDB encryption at rest enabled.

Application security

• OWASP Top 10 review on every release.
• Server-side XSS sanitization on every user-supplied string (job titles, descriptions, messages, addresses).
• Strict CSP-compatible response headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
• Password hashing via bcrypt (cost factor 12).
• Cryptographically secure RNG (Python secrets module) for OTPs, temp passwords, and reward draws.
• Mandatory password confirmation on destructive actions (archive, delete, bulk operations).
• Role-based access control on every endpoint, enforced server-side.
• Verification gate: workers, employers, and agents cannot use the platform until an admin approves their profile.

Infrastructure

• Hosted in SOC 2 Type II compliant cloud regions.
• Network segmentation between web tier, application tier, and database.
• Daily encrypted backups with 30-day retention.
• Disaster recovery RTO: 4 hours. RPO: 1 hour.

Vulnerability disclosure

Found something? We want to know.

• Email security@scensobconnect.com (PGP key on request).
• Please do not disclose publicly before we've had 90 days to remediate.
• We acknowledge reports within 24 hours and aim to remediate critical issues within 7 days.

Compliance

• HIPAA: BAA available for covered-entity customers. See our HIPAA notice.
• SOC 2 Type II: Audit in progress, report available under NDA.
• CCPA / GDPR: Data-subject requests at privacy@scensobconnect.com.