Security at PivotOps

PivotOps handles sensitive information — candidate records, compliance documents, and workforce data. Security is built into the foundation of the platform, not bolted on afterward. This page describes the controls and practices we use to protect your data, your candidates, and your business.

Data isolation (multi-tenancy)

PivotOps is a multi-tenant platform, and every organization's data is logically isolated from every other. We enforce this at the database level using Row-Level Security policies, so a request can only ever reach data belonging to the authenticated organization. Every query is scoped to the caller's tenant on the server — never based on values supplied by the browser.

Authentication & access control

User sessions are cryptographically verified on every request. Access is role-based — organization owners, recruiters, and candidates each have distinct, enforced permission boundaries, and users cannot reach areas outside their role. Sensitive operations are authorized server-side, and administrative functions are protected by separate, dedicated credentials.

Encryption

All traffic to and from PivotOps is encrypted in transit over HTTPS, with HTTP Strict Transport Security (HSTS) enforced. Data at rest is encrypted through our infrastructure providers.

Infrastructure

PivotOps is built on enterprise-grade, SOC 2-compliant infrastructure providers (Supabase and Vercel) for hosting and data storage. The underlying platform inherits robust physical security, network protection, and operational controls maintained by providers whose security posture is independently audited.

Application security

Our application layer includes multiple defensive controls:

• Rate limiting on public and authenticated endpoints to prevent abuse
• Strict input validation on all incoming requests
• Security headers including Content Security Policy, HSTS, and content-type protection
• Audit logging of sensitive actions for accountability and traceability
• Ongoing dependency monitoring and prompt patching of known vulnerabilities

Compliance & data handling

Compliance tracking is a core part of PivotOps. Candidate credentials and documents are stored securely, access is controlled and logged, and organizations retain oversight of their own data. We handle personal data with care and in line with applicable data protection principles. For details on how data is collected and used, see our Privacy Policy.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in PivotOps, please contact us at inquiries@pivotops.app and we will respond promptly. We ask that you give us a reasonable opportunity to address the issue before any public disclosure.