Trust Centre

Transparency into JobKred’s security posture — where we genuinely stand today, the certifications behind the infrastructure we run on, and the controls we operate day to day across the Ellie and Lithium platforms.

Where we stand today

We claim only what we can evidence. Capabilities are stated where they are implemented, and what is still ahead of us sits on the roadmap.

Singapore, built to the PDPA

JobKred is a Singapore company. The platform — application, databases and your file storage — runs in Amazon Web Services’ Singapore region, and the design is aligned with the principles of the Personal Data Protection Act. To deliver AI features, AI requests are processed by our AI provider in the United States — see Third-Party & AI below.

Enterprise due diligence supported

We support enterprise due diligence, including reviews by financial institutions and other regulated organisations, with control-by-control documentation and past assessment reports released under NDA.

Certification roadmap

JobKred’s platform runs on certified AWS infrastructure, listed below. JobKred does not hold its own certifications yet — ISO 27001 is on our roadmap.

Infrastructure certifications

These certifications are held by Amazon Web Services and cover the cloud infrastructure layer JobKred runs on.

ISO/IEC 27001

Information Security Management. Held by AWS, covering the cloud infrastructure layer.

ISO/IEC 27017

Cloud-specific security controls. Held by AWS, covering the cloud infrastructure layer.

ISO/IEC 27018

Protection of personally identifiable information in the cloud. Held by AWS, covering the cloud infrastructure layer.

SOC 1

Controls relevant to financial reporting. Held by AWS, covering the cloud infrastructure layer.

SOC 2

Security, availability and confidentiality. Held by AWS, covering the cloud infrastructure layer.

PCI DSS Level 1

Payment card industry standard. Held by AWS, and separately by Stripe, our payment processor — card details are collected and stored by Stripe and never reach JobKred’s servers.

FISMA Moderate

United States federal information security standard. Held by AWS, covering the cloud infrastructure layer.

99.90%

Lithium uptime SLA

AES-256

Encryption at rest

Zero

Customer data used to train AI models

2024

Latest independent assessment (Lithium)

Independent assessments

Third-party assessments of the JobKred Lithium platform, covering the OWASP Top 10, authentication, session management, access control, input validation, business-logic flaws and network-level vulnerabilities. An independent assessment of the Ellie AI-agent platform is planned. Full reports are available on request under NDA.

Penetration Test, 2024

Conducted by Horangi Pte. Ltd. Most recent engagement. Report available on request under NDA.

Penetration Test, 2022

Conducted by Horangi Pte. Ltd. Report available on request under NDA.

Self-Security Assessment (SSAT), 2020

Conducted by Centurion Pte. Ltd. Report available on request under NDA.

Penetration Test, 2020

Conducted by Centurion Pte. Ltd. Report available on request under NDA.

Static Code Analysis, 2019

Conducted by IMDA. Report available on request under NDA.

Penetration Test, 2018

Conducted by NSHC. Report available on request under NDA.

Our controls

The controls we operate across JobKred’s production environments on AWS. Where a control applies to one platform only, it says so.

Data Security

All data encrypted in transit using TLS — there is no non-TLS option for connecting to JobKred, and failed TLS connections never fall back to an insecure channel.
AES-256 encryption at rest via AWS managed-service encryption, with dedicated AWS KMS keys per environment using FIPS 140-2 validated modules, automatic annual key rotation, and a full audit trail of key usage via AWS CloudTrail.
Integration credentials carry an additional, dedicated layer of application-level encryption on top of storage encryption.
Database backups encrypted with per-environment AWS KMS keys and held separately from live systems; access to backup storage and restore operations is restricted to authorised operations personnel through IAM controls, and all such access is audit-trailed.
File attachments stored in Amazon S3; downloads use presigned, time-limited links with cryptographically strong random components, over HTTPS only.
Personal data is deleted within 30 days of a verified request; residual copies age out of encrypted backups as the retention window expires, with audit records aged separately on their own schedules.
No unencrypted credentials stored in source code repositories.

Access Control

Multi-factor authentication enforced on JobKred’s own corporate and infrastructure accounts — including Google Workspace, AWS, GitHub, Google Cloud Platform and every third-party service that supports it.
Sign in with Google or Microsoft (OIDC) is available on the Ellie platform, and optional email-based two-factor verification on Lithium; end-user MFA and enterprise SAML/SSO for Ellie are planned.
Role-based access control with least-privilege permissions at the application layer, backed by a documented role-by-resource access matrix reviewed at least annually.
All internal services reachable only via VPN; no direct public internet access.
On the Lithium platform, account lockout after 10 consecutive failed logins with a 15-minute cooldown; Ellie sign-in and account-recovery endpoints are rate-limited.
Password policy enforces minimum complexity; the Lithium platform additionally screens candidate passwords against a database of 10 million known compromised passwords, with breached-password screening for Ellie planned.
Tenant data segregation enforced on every request — Ellie re-verifies organization membership against the database, and Lithium scopes every query to the tenant validated in the session token; dedicated single-tenant deployment of the Lithium platform is available on request.
On the Ellie platform, sessions default to a 7-day lifetime, and removing a user or changing a password signs out existing sessions immediately, across every device.
Secrets managed centrally via AWS Secrets Manager, encrypted with each environment’s own KMS key; the infrastructure defines no standing IAM users or access keys — humans sign in via SSO, and CI/CD deploys via short-lived federated credentials with no long-lived deploy keys.

Product Security

All code changes are reviewed before merge, and automated backend and frontend test suites gate every deployment.
Secret and credential scanning covers the entire codebase and git history — on every push on the Lithium platform and gating every pull request on Ellie; a confirmed leak triggers immediate rotation of the affected credential.
On the Ellie platform, CodeQL static analysis runs on every pull request and weekly, with Dependabot dependency scanning across Python, npm, GitHub Actions and Docker; dependency scanning in CI for Lithium is planned.
Security response headers — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — on Ellie API responses, with HSTS and hardening headers applied at the Lithium edge.
Container images are built on minimal bases and run as non-root users; every build is automatically scanned via AWS ECR before deployment, and images with critical vulnerabilities do not qualify for deployment.
Secure development follows an OWASP-based coding baseline: input validation and strictly parameterised data access — no string-concatenated SQL.

Network Security

On the Lithium platform, AWS Web Application Firewall with managed rule sets: Amazon IP Reputation, Anonymous IP (VPN, Tor and hosting-provider exits), Core Rule Set (OWASP/CVE) and Known Bad Inputs — rule changes deploy within minutes.
On the Lithium platform, AWS Shield Standard absorbs volumetric denial-of-service attacks in front of CloudFront and the load balancers, with auto-scaling absorbing traffic surges during mitigation.
On the Lithium platform, all databases, caches and compute hosts are deployed in private subnets — public exposure is limited to the load balancer (HTTPS) and the VPN endpoint — with least access enforced at the network level: no ports open by default, all routing explicitly defined.
On the Lithium platform, no SSH access to production systems — remote administration is conducted exclusively via AWS Systems Manager, with a 30-minute idle timeout and sessions logged to dedicated encrypted storage, and outbound connectivity controlled through NAT gateways.
WPA2-AES encryption on all corporate wireless networks, with separate employee and guest segments.

Infrastructure

Hosted on Amazon Web Services, Asia Pacific (Singapore) region.
Container orchestration via Amazon ECS with immutable Docker images.
Development, staging and production run in fully separate AWS accounts — a boundary enforced by AWS itself — each environment in its own VPC with no shared resources.
Multi-Availability-Zone deployment across all components, in at least two Availability Zones, with auto-scaling.
On the Lithium platform, Bottlerocket OS — immutable, minimal-footprint Linux — for all container hosts, which are replaced weekly through the automated patching cycle scheduled via AWS EventBridge.
On the Lithium platform, container images are retained for a minimum of 30 days in AWS ECR to support rollback.
Cloud configuration is continuously assessed with Prowler, AWS Security Hub and AWS Config, with alarms aligned to the CIS AWS Foundations Benchmark.
Infrastructure changes apply only through reviewed, approved pull requests, and the deployment automation cannot create IAM users or disable the audit plane (CloudTrail, AWS Config, Security Hub).

Corporate Security

Actively maintained antivirus and endpoint protection required on all corporate machines.
Production environment access restricted to VPN-connected, authorised systems only.
Mandatory security awareness training covering social engineering, phishing and credential hygiene, administered at onboarding and upon policy updates.
Criminal background checks conducted for all personnel with access to production environments.
Confidentiality agreements signed by all employees; non-disclosure agreements in place with third parties as appropriate.
Production-critical data is never stored on physical media outside our hosting provider’s production environments.
Hardware serviced exclusively through manufacturer-authorised channels.

Disaster Recovery & Business Continuity

99.90%+ uptime maintained consistently on the JobKred Lithium platform since 2017.
Committed recovery targets: RPO ~5 minutes / RTO 1 hour for single-component failure, RPO 1 hour / RTO 24 hours for dual-AZ failure, and RPO 24 hours / RTO 72 hours for full-region failure — these are target maximums, and Multi-AZ failover ordinarily completes within minutes; the business-continuity architecture is tested regularly.
Point-in-time recovery from database transaction logs captured roughly every 5 minutes, plus a full database snapshot every 24 hours; backups are retained for 32 days, then automatically and irrecoverably destroyed.
File storage relies on Amazon S3’s built-in redundancy, which Amazon states provides 99.999999999% yearly durability.
Shared-infrastructure backups restore whole systems rather than per-customer subsets — customers wanting an independent record are advised to export data periodically, and dedicated-infrastructure customers have per-tenant recovery available.

Incident Management

Incident response framework based on NIST SP 800-61: Detection and Analysis, Severity Categorisation, Containment, Eradication, Recovery, Notification and Post-Incident Review, across four severity levels — Crisis (S0), Critical (S1), Major (S2) and Minor (S3) — with classification per the Verizon VERIS framework.
Defined incident roles — Coordinator, Analyst, Communications Lead and supporting advisors — with external cybersecurity specialists engaged where an incident requires additional capacity or independent review.
Documented playbooks for phishing, malware, ransomware and internet-facing (DDoS) scenarios; preventive controls include DKIM, SPF and DMARC on our domains, with corporate email screened for phishing and malware before delivery.
Affected customers are notified without undue delay when their data is involved in a confirmed incident; breaches notifiable under the PDPA are reported to the PDPC within the statutory timeframe, and customers subject to the GDPR are supported to meet their 72-hour notification obligation.
Systemic weaknesses identified in post-incident reviews are recorded and tracked in the Corporate Risk Register with owners and target dates.

Monitoring & Logging

Continuous uptime monitoring, with 99.90%+ availability tracked on JobKred Lithium since 2017.
On the Ellie platform, application performance monitoring via Datadog — structured JSON logs with distributed trace correlation, error tracking and frontend real-user monitoring — plus Langfuse tracing for AI interactions.
On the Lithium platform, application performance monitoring via SigNoz with OpenTelemetry instrumentation, error tracking via Bugsnag, server metrics via Prometheus, uptime via UptimeRobot, and infrastructure monitoring via AWS CloudWatch — all with threshold-based alerting.
On the Ellie platform, authentication and resource audit events are retained indefinitely for forensic value; per-node workflow telemetry is purged after 90 days.
On the Lithium platform, application logs are retained 15 days in the live monitoring stack and 1,100 days in S3 (archived after 90 days), with authentication logs retained for 2 years and activity audit logs indefinitely; access logs, user activity and system audit logs are reviewed monthly, with a review report retained and distributed.
AWS audit logs — CloudTrail, VPC flow logs and load-balancer access logs — are retained indefinitely and replicated to dedicated security accounts, so log evidence survives a workload-account compromise.
Administrative and account activity captured in an append-style audit trail — who did what, when and from where.

Third-Party & AI

Your data is never used to train AI models. JobKred does no model training of its own, and our AI provider is contractually barred, under its commercial API terms, from training on data sent through the API.
Every request we send to our AI provider carries a do-not-retain instruction telling the provider not to keep the prompt or the output on its side — enforced in code and verified by automated tests on every change.
Customer files are not uploaded to the AI provider’s storage — documents are processed for answers, and results are stored in your workspace as content you own.
AI context is assembled only from resources the requesting user can already access — retrieval never crosses organisations.
Built-in guardrails resist attempts to manipulate the AI with malicious instructions, and organizations can enable additional content policies.
Workflows can pause and wait for a person’s decision before continuing, so no consequential outcome is handed over without the chance to review it.
AI requests are processed by our AI provider, OpenAI, in the United States; transactional email is delivered via SendGrid (US); AI-interaction traces are held by Langfuse; monitoring uses Datadog; payments are handled by Stripe. Per-product subprocessor tables — the data categories each provider handles and processing regions — are maintained and available on request.
Our AI provider maintains SOC 2 Type II certification, and a Data Processing Addendum with the provider is in place.
Data-processing terms are in place with vendors that process personal data; pre-contract due diligence is tiered to vendor risk — up to full security assessments for critical vendors — and vendor posture is reviewed annually and on material change.
Internal analytics (self-hosted within our private network) reads production data through a restricted, read-only role with scoped views and validated queries; no customer data leaves through it.
Data minimisation principles applied: only the minimum data necessary is shared with each provider, processing is real-time wherever possible with provider-side retention disabled or minimised, and third-party sharing is reviewed annually.

External Audits

2024: Penetration Test conducted by Horangi Pte. Ltd. — most recent; no critical findings, and all findings remediated before closure.
2022: Penetration Test conducted by Horangi Pte. Ltd.
2020: Self-Security Assessment Tool (SSAT) conducted by Centurion Pte. Ltd.
2020: Penetration Test conducted by Centurion Pte. Ltd.
2019: Static Code Analysis conducted by IMDA.
2018: Penetration Test conducted by NSHC.
Scope covers the OWASP Top 10, authentication, session management, access control, input validation, business logic flaws and network-level vulnerabilities.
These engagements assessed the JobKred Lithium platform. The Ellie platform undergoes internal security reviews and automated penetration testing (most recently 2026, all findings triaged); an independent third-party assessment of Ellie is planned.
Full assessment reports available upon request under NDA.

SLA & Support

99.90% guaranteed server uptime on the JobKred Lithium platform.
Support available during Singapore business hours: Monday to Friday, 10:00 AM – 7:00 PM SGT.
Response time typically within one business day.
Structured escalation path: ticket creation, Customer Success Manager review, Technical Lead escalation, resolution.
Custom SLA tiers available on request, with response and recovery commitments agreed contractually.

Read further

Request the full Security & Compliance documentation How we protect your data Standard Software Services Agreement Privacy Policy

Running a vendor security review?

For security questionnaires, past assessment reports under NDA, or to schedule a review with our team, get in touch.

We support enterprise due diligence with control-by-control documentation. Last reviewed: August 2026.

Request the full documentation

The complete Security & Compliance documentation pack is shared under NDA. Send us a request and our team will review it and reach out to you.

We use these details only to review your request and share the documentation, and keep them no longer than the agreement requires. See our privacy policy.