Security practices

This page summarises controls Google and schools can expect when Edcruiter uses Sign in with Google for authentication only (email, name, profile). We do not access Gmail or other Google Workspace APIs.

Transport security

• Production traffic is served over HTTPS / TLS
• HTTP Strict Transport Security (HSTS) is enabled
• OAuth authorised JavaScript origins and redirect URIs will be HTTPS on a domain we own

Application security

• Security headers: nosniff, frame controls, referrer policy, permissions policy
• OAuth client secrets and API keys are kept in server environment variables, never in the browser bundle
• When Google Sign-In is connected, session cookies will be Secure, HttpOnly, and SameSite
• Scopes requested: openid, email, profile only

Assessment media

Camera and microphone are used only during a candidate assessment, with in-browser integrity checks. Media is uploaded over HTTPS to our backend for scoring by the inviting school.

Access control

School staff see only candidates for their organisation. Teachers see their own applications and assessments. Super-admin access is restricted to operators.

Incident contact

Report a vulnerability or data incident to privacy@edcruiter.com.

See also Privacy Policy and Terms of Service.