Security
at Rolefern.

Rolefern runs on Amazon Web Services. The production database, uploaded files and the outgoing email service are configured in Frankfurt, Germany. Content delivery may use AWS edge locations. We rely on AWS for physical security and infrastructure maintenance of the underlying platform.

Sign-in uses a custom session-cookie system with database-backed sessions. Passwords are never stored in plain text; they are stored as bcrypt hashes with a work factor of 12. Essential session cookies keep you signed in, and short-lived security cookies protect email confirmation and Google sign-in.

You can also choose Google Workspace sign-in. We accept it only for verified work-domain email addresses, not personal Gmail accounts. This sign-in does not request access to Gmail, your contacts or your Google Calendar, and we do not sell Google user data or use it for advertising. Each workspace has two roles: an ADMIN, who can manage settings, and a MEMBER, who can view and review.

Each organisation’s workspace is kept separate. Every query that reads or writes workspace data is scoped by company, so one workspace is designed not to see another’s candidates, jobs or messages. We treat this boundary as a core rule of the service.

Uploaded files such as CVs and attachments are held in a private Amazon S3 bucket that is not publicly readable. When someone with access needs to open a file, Rolefern generates a time-limited presigned URL for that specific download, rather than exposing files through a permanent public link.

Transactional email, such as invitations and notifications, is sent through Amazon SES. Subscription payments are handled by Stripe: card details are entered on Stripe’s own checkout and billing portal. Rolefern stores only billing identifiers and your subscription status, never your card number.

The hiring organisation decides what candidate information to collect and how long to keep it. Rolefern provides tools for candidate consent, configurable retention and candidate access, export and erasure, so organisations can meet their obligations. You can read more in our privacy notice.

You may also contact your data protection authority; in Croatia this is AZOP. We describe our practices honestly and do not claim security certifications such as SOC 2 or ISO 27001, which we do not hold.

If you believe you have found a security issue, or you have a question about how your data is protected, please get in touch so we can look into it.

Contact Pinky Fish d.o.o. about Rolefern security at dominik@coreline.agency. Please describe the issue and, if relevant, your workspace so we can respond.