Security posture
We treat candidate, employer and recruiter data as protected by default. Everything below is enforced — not aspirational.
Encryption in transit & at rest
TLS 1.2+ on every request. Database storage encrypted with AES-256. CVs and documents stored in isolated buckets.
Identity & access
Passwords hashed with bcrypt. Optional Google sign-in. Role-based access (candidate, recruiter, administrator).
Zambian data residency
Primary database and storage hosted in Zambian-controlled infrastructure. No raw PII leaves the region.
Row-level security
Every table enforces row-level policies scoped to the authenticated user — admins are the only exception, and we audit them.
Automated backups
Daily snapshots with point-in-time recovery for the last 7 days.
Incident response
We disclose material incidents to affected accounts within 72 hours, with what happened, what data was touched, and what we did.
Report a vulnerability
Found something? Email security@fortresszm.com. We respond within one business day, and we don't pursue legal action against good-faith researchers.