Security

01Infrastructure

JobsKru runs on managed cloud services rather than servers we operate ourselves:

• The website and API run on Cloudflare Workers, behind Cloudflare’s network, which provides firewalling and DDoS mitigation.
• Account, job and application data is stored in a managed PostgreSQL database on Supabase.
• Images and videos are stored in Cloudflare R2. Sensitive documents (such as identity and bank documents for the affiliate programme) are kept in a separate private storage bucket that has no public address and is reachable only through our API.
• Payments are handled by Stripe. Card details go straight to Stripe and never touch JobsKru’s servers; we do not store card numbers.

These providers secure their own data centres and hardware; we rely on their published controls for physical security.

02Encryption

• In transit: every page and API call is served over HTTPS (TLS). Our file domain, cdn.jobskru.com, accepts TLS 1.3 only.
• At rest: the database and file storage are encrypted at rest by our providers.
• Sensitive fields: Thai ID and tax ID numbers and bank account numbers given for affiliate payouts are encrypted by our API with AES-GCM before they are stored, and only the last four digits are kept in readable form. Uploaded identity and bank documents are encrypted the same way.

03Accounts and sign-in

• Passwords are stored only as Argon2id hashes, never in readable form.
• You can turn on two-step verification, so signing in also needs a one-time code.
• Session tokens are random, kept in secure, HttpOnly cookies that page scripts cannot read, and stored on our side only as hashes. Sessions expire after 30 days.
• You can see the devices signed in to your account and sign any of them out.
• Educator and employer accounts are separate, and employers only see the organisations they belong to, with the role they have been given there.

04Application security

• Access rules are enforced in the database itself (PostgreSQL row-level security), so a request can only read or change the rows its user is allowed to, even if application code has a bug.
• Forms are protected with Cloudflare Turnstile against bots, with cross-site request forgery (CSRF) checks, and with rate limits on sign-in, sign-up and other sensitive actions.
• Text that schools and educators write, such as job descriptions, is sanitised before it is shown, to prevent cross-site scripting.
• Uploads are checked for type and size before they are stored.
• We design and review the code against the OWASP Top 10 risks.

05Access by JobsKru staff

• Administrative access is limited to platform administrators, and the most sensitive areas (such as affiliate payout details) to super administrators.
• Viewing sensitive documents, and other administrative actions on accounts and organisations, require a stated reason and are recorded in an audit log.
• Production secrets and encryption keys are kept in our hosting providers’ secret stores, not in source code.

06Privacy and personal data

We handle personal data in line with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). We keep a record of processing activities, collect only what the service needs, and keep it only as long as necessary.

Analytics cookies are used only if you agree, and never on pages where you are signed in. See the Privacy Policy, the Personal Data Protection Policy and the Cookie Policy for details.

07Incident response

If we detect a security incident, we contain it, investigate what happened, and fix the cause. If a personal data breach is likely to put people at risk, we notify the Personal Data Protection Committee and the people affected, as the PDPA requires.

08Reporting a vulnerability

If you think you have found a security issue in JobsKru, please tell us at security@jobskru.com. Our Vulnerability Disclosure Policy explains what to include, what is in scope, and how we will work with you.

09Contact

Questions about security: security@jobskru.com. Questions about your personal data: privacy@jobskru.com.