Trust & Security

Last updated: July 23, 2026

This page describes, plainly and without overstatement, the security practices already built into the CargoFL Talents hiring platform. We would rather list fewer, verifiably true things than claim a certification we don’t hold — see “What we don’t claim” below.

Assessment & proctoring data

  • Computer-vision analysis of your webcam (face presence, gaze direction, phone detection) runs entirely in your own browser, on your own device. Raw video never leaves your device — only periodic low-resolution snapshots and short text flags are sent to our servers, and only during a proctored assessment you've been asked to take.
  • Every proctoring signal is advisory. None of them automatically reject or disqualify a candidate — a human reviewer always makes that call. See our Assessment Monitoring FAQ for the full explanation.
  • Camera and screen snapshots, and interview/round recordings where applicable, are only ever visible to your hiring team and, for blind technical review, an assigned reviewer who does not see your contact details.

Application data & file uploads

  • Resumes and other uploaded files are checked against their real file format (not just the label your browser sends), and we specifically screen for known evasion techniques — encrypted PDFs, zip-bomb-style compressed documents, and hidden active-content/script payloads — before we ever try to read them.
  • Uploaded files are streamed to disk and processed in bounded chunks rather than held whole in server memory.
  • Resumes and photos are never served publicly — every download requires an authenticated HR session.

Accounts & access

  • HR sign-in tokens are cryptographically signed and stateless; they can't be forged without our server's private key.
  • Access is role-based: a read-only “viewer” role is blocked from every data-changing action across the entire HR dashboard, not just the pages we remembered to add a check to.
  • Reviewers, candidates, and interview scheduling all use single-purpose, unguessable links instead of shared logins — a reviewer can never see your contact details, and a status link can never see anyone else's application.
  • OAuth tokens for connected calendar/video-conferencing accounts (Google, Microsoft, Zoom) are encrypted at rest, not stored in plain text.

Network & infrastructure

  • All data in transit is encrypted (HTTPS).
  • Abuse-prone public endpoints (login, resume upload, application submission) are individually rate-limited.
  • Database queries are parameterized throughout — user input is never concatenated into SQL.

What we don’t claim

We do not currently hold a third-party security certification such as SOC 2 or ISO 27001. CargoFL Talents is an internal hiring system built and operated by CargoFL for CargoFL’s own recruitment — it is not sold or offered as a product to other companies, and our security investment is scoped accordingly. If you have a specific compliance question, contact us at dpo@cargofl.com.

Related pages

← Back to Careers