TrueExpert

Security

Last updated: November 2026.

This page lists only the protections that are actually built into TrueExpert. We do not claim certifications or audits that we do not have.

1. Connection

The site and the API are served over HTTPS (TLS), and in production the sign-in cookie is marked secure, so it is sent only over an encrypted connection.

2. Passwords and sign-in

  • Passwords are stored only as hashes, never as plain text.
  • Sign-in uses a token kept in an httpOnly cookie, which scripts running in the page cannot read. The cookie uses SameSite=Lax and expires after 7 days.
  • E-mail verification is required before content can be made public.
  • Password reset and e-mail verification links are tied to your account and expire.
  • Two-factor authentication is not available at the moment.

3. Access control

  • Roles: candidates, employers and administrators have separate permissions, and administration is available only to administrators.
  • Company members can see a company's vacancies and applications only if they were added to that company.
  • A candidate's name and contacts are hidden from employers until contacts are opened for an offer.
  • Permissions are checked on the server for every request, not only in the interface.

4. Abuse protection

  • Rate limits on applications, quick applications, reports, vacancy and resume creation, alerts, invitations and one-click links, and on search suggestions and the map.
  • Validation of input on the server, and limits on the size of uploaded files.
  • Limits on the number of vacancies, resumes and applications per account and per day, duplicate detection, and e-mail verification before publishing.
  • Unsubscribe and "stop sending" links are signed, and the application links sent to employers are single-use.

5. Content moderation

Vacancies and resumes pass rule-based checks and administrator review, and optionally an automated AI check. Reports from several users hide content until an administrator decides. See the Privacy Policy for what data an AI check uses.

6. Your own key for AI features

If you choose to use your own Google API key, it is kept only in your browser, and the content goes directly from your browser to Google, not through our servers. Keep the key private and revoke it in your Google account if you think it has leaked.

7. What you can do

  • Use a long, unique password.
  • Do not share your sign-in link or the link from an application e-mail.
  • Be careful with employers who ask for money, copies of documents or bank details, and report them.
  • Sign out on shared computers.

8. Report a security issue

If you found a vulnerability or suspicious activity, write to support@true.expert with a description and, if possible, steps to reproduce. Please do not publish details before we have had a chance to fix the problem, and do not access other people's data.