Security
Hosting, encryption, access control, webhook integrity, and disclosure — the operational picture.
Last updated 26 May 2026 · All policies
01Hosting and data location
Application + APIs: Vercel (primary region: London / lhr1, with global edge). Database: Neon managed Postgres (EU region). Object storage: Cloudflare R2 (EU jurisdiction). Where a sub-processor sits outside the UK / EEA, transfers are governed by the UK IDTA.
02Encryption
TLS 1.3 in transit. AES-256 at rest on managed providers. Backups encrypted with provider-managed keys.
03Authentication and access control
Clerk (SOC 2 Type II) for identity. Admin role required for privileged actions; admin-tier changes write to an append-only audit log retained for 5 years. Production database access is restricted to break-glass procedures with logging.
04Secrets handling
All secrets in Vercel encrypted environment variables, scoped per environment. The .env* family is gitignored across the entire repository.
05Webhook integrity
Stripe, Vapi and other third-party webhooks are verified via HMAC-SHA256 with constant-time comparison. Unverified requests are rejected with HTTP 401 in production.
06Data isolation
Per-tenant data is segmented via Postgres row-level security. A Talent Search subscriber cannot read another employer's shortlists, intakes or messages even with direct DB access.
07Voice handling
Vapi recordings live in a private R2 bucket; access is via signed URLs with a 1-hour expiry. Recordings auto-delete after 90 days unless flagged for compliance retention.
08Disclosure
Report a vulnerability in good faith to security@fdeos.com. We commit to a holding response within 24 hours and not to pursue legal action where disclosure follows responsible-disclosure norms (no exfiltration, no DoS, no social engineering of our staff).
Email privacy@fdeos.com · we reply within one business day. Security disclosures: security@fdeos.com.