Access. Every page and request checks who is asking. An account sees the applicants for the jobs it posted; the wider network stays masked; organization roles decide who can invite, edit the brand or read the activity log.
Passwords and sessions. Passwords are stored only as hashes, never in plain text. A sign-in lasts at most 24 hours; while you work, it is renewed in the background.
Data. Traffic is encrypted in transit and data at rest, and per-employer sign-ins such as Zoom and Google are stored encrypted.
The firewall. Offerrole runs an application firewall in front of every page that rate-limits and blocks abusive traffic. It is no substitute for network-level protection against very large floods, and the platform doesn't pretend otherwise.
The record. Every candidate view, export and configuration change is written to the platform's append-only audit log; every consent change to the hash-chained consent ledger.
Posting and reviewing are free. Every stage, e-mail and export described here is in the console from the first sign-in.