Security

Last updated 26 October 2026

AI Connector for JobAdder sits between your JobAdder account and AI apps. This page summarises how it protects that access.

Access and authorization

• AI apps connect with OAuth 2.1 and PKCE. Every connection shows a consent screen where you choose whether the app may make changes and manage automations; reading is the only permission granted by default.
• The connector acts as your JobAdder user, so it can never see more than you can in JobAdder. Accounts are isolated: data from one JobAdder account is never available to another.
• A separate read-only endpoint exposes only read tools, for unattended scheduled tasks. JobAdder administrators can make the connector read-only for their whole account.
• Access tokens are short-lived and bound to the endpoint they were issued for. Refresh tokens rotate on every use, and reuse of an old refresh token revokes the authorization.
• You can remove any AI app's access, or delete all of your data, from the dashboard at any time.

Data protection

• All traffic uses TLS. JobAdder tokens and automation destinations are encrypted at rest with AES-256-GCM.
• Tokens we issue, sessions and verification codes are stored only as hashes.
• Record contents are not stored. Sensitive candidate fields are withheld unless an administrator allows them.
• The audit log records who did what and when, with record ids and changed field names, but never record contents or argument values.

AI-specific safeguards

• Free text from JobAdder (notes, resumes, descriptions) is labelled as quoted content, not instructions.
• Tools that change data are marked as such, so AI apps ask for your confirmation before running them.
• Automations only read JobAdder and deliver only to email addresses and Slack channels you have verified.
• Bulk changes are capped, and requests to JobAdder are rate limited per account.

Infrastructure

The Service runs on Vercel in Sydney, Australia, with a managed Postgres database (Neon) and a managed Redis cache (Upstash). See subprocessors.

Reporting a vulnerability

Email support@example.com with “Security” in the subject. Please include steps to reproduce, avoid accessing data that is not yours, and give us reasonable time to fix the issue before disclosing it. We will acknowledge your report promptly. The same contact is published in /.well-known/security.txt.