No job-board passwords, anywhere
You sign in yourself and the work happens inside that session. There is no credential store for SEEK to breach, because there is nothing in it.
Security
The safest data is the data we never hold
Most of the security posture here is architectural rather than operational: the product is built so that the most valuable thing an attacker could want is not in it.
True today
What is in place
Documents encrypted before they leave the application
Résumés, cover letters and profile images are encrypted with AES-256-GCM before they are uploaded, so the storage layer never holds a readable copy of them. All traffic is TLS. Payment card details never reach our systems at all — they go directly to the payment processor.
Fenced ownership of every run
A run is leased, and the lease is fenced: an old worker that wakes up after losing its lease cannot act. This is a data-integrity control as much as a security one — it is what stops two machines submitting the same application.
Isolated, monitored infrastructure
The platform runs on a private cluster with network policy enforcement, runtime security monitoring, vulnerability scanning and policy admission control, with logs and metrics retained under a defined retention policy.
What we deliberately do not hold
Each of these is a breach that cannot happen here, because the data is not present.
- Your job-board passwordsNever requested, never received.
- Your payment card detailsHeld by the payment processor, not by us.
- Your identity documentsNever uploaded on your behalf.
- Employer-side accountsThere is no employer product, so there is no employer data.
Not done yet
The database volume is not encrypted at rest. Documents are — they are encrypted by the application before they are stored — but the database holding your profile, your applications and the answers you gave employers sits on an unencrypted filesystem, as does the object store underneath the encrypted documents. Disk-level encryption of both is outstanding work, not a decision we have made against.
No independent penetration test has been completed. No SOC 2 or ISO 27001 certification exists, and we are not going to imply one with a badge. A formal vulnerability disclosure process is being written; until it is published, security reports should go through the contact page and will be acknowledged.
Listing these is not a disclaimer. Anyone evaluating a product like this seriously will ask, and a security page that answers only with its strengths is the least trustworthy document a company publishes.
Before you ask
Where is my data stored?
Primarily in Australia, on infrastructure we control. Processors that operate elsewhere are named by category in the sub-processors document.
Is my CV used to train AI models?
No. Content is sent to model providers to generate your documents and answers, on terms that do not permit training on it, and we do not train our own models on it.
How do I report a vulnerability?
Through the contact page, marked as a security report. You will get an acknowledgement from a person, and we will not threaten anyone who reports something in good faith.
Read the privacy policy too
It says what we hold, why, and who else sees it — in specifics rather than in template language.