Security posture
ADVIS treats candidate, employer and recruiter data as confidential by default. The controls below describe how the platform is currently configured.
Encryption in transit & at rest
HTTPS (TLS 1.2+) on every request. The managed database encrypts storage at rest; uploaded documents live in isolated buckets.
Identity & access
Passwords hashed by our auth provider. Optional Google sign-in. Roles separate candidate, recruiter and administrator capabilities.
Zambia-hosted database
The primary database and storage buckets are hosted in the region. Raw personal data is not routinely transferred outside the region for ordinary processing.
Row-level security
Tables holding personal data enforce row-level policies scoped to the authenticated user. Administrative access is auditable.
Backups
Daily backups with point-in-time recovery for the last 7 days, provided by our managed database.
Incident response
We aim to notify affected accounts of material incidents within 72 hours, describing what happened, what data was touched and what we changed.
Concrete controls
- • Row-Level Security enabled on tables holding personal data; user-scoped policies use
auth.uid(). - • Service-role credentials are kept server-side; privileged operations run inside server functions and verified webhooks.
- • Password storage uses our auth provider's hashing; leaked-password protection is available on request.
- • Managed backups with 7-day point-in-time recovery.
- • Append-only decision audit log; recruiters cannot delete their own logged actions.
- • Uploaded CVs live in isolated buckets; recruiter access goes through short-lived signed URLs.
Last reviewed June 2026.
Report a vulnerability
Found something? Email security@fortresszm.com. We aim to acknowledge within one business day and do not pursue legal action against good-faith researchers.