Security Protocols & Data Safeguards
Enterprise security procedures, encryption standards, and threat prevention architecture protecting the Quaddis Career Platform.
1. Security Architecture Overview
QUADDIS employs a multi-tiered, defense-in-depth security framework designed to protect candidate career records, intellectual property, and payment workflows. Our cloud infrastructure leverages Google Cloud Platform and Firebase Firestore with automated compliance enforcement.
All user passwords are encrypted using unique 16-byte cryptographically secure random salts and scrypt key derivation. Verification uses constant-time comparison to prevent timing side-channel attacks.
Attribute-Based Access Control and strict Firestore Security Rules isolate CV scans into private subcollections. Cross-account data leaks are structurally impossible.
Sliding-window IP rate limiters restrict authentication attempts to 10 tries per 5 minutes, preventing dictionary attacks and automated credential stuffing.
2. Encryption in Transit and at Rest
- Transport Layer Security (TLS 1.3): All network communications between browsers and our servers are encrypted with high-grade SSL/TLS ciphers.
- Storage Encryption (AES-256): All database records and uploaded documents are encrypted at rest using industry-standard Advanced Encryption Standard.
- HTTP-Only Cookie Sessions: Session tokens are signed using HMAC-SHA256 and stored in HTTP-Only, SameSite cookies, making them inaccessible to malicious client-side JavaScript (anti-XSS).
3. Role-Based Access Control (RBAC)
Administrative endpoints and database oversight portals (such as the Director Console at /admin) require authenticated session validation with role verification. Regular candidates and unauthenticated visitors attempting to query management routes receive immediate 403 Forbidden responses.
4. Responsible Vulnerability Disclosure
We welcome collaboration with cybersecurity researchers. If you identify a potential security vulnerability, please report it directly to our security response team:
Security Response: Global Security & Vulnerability Response Desk (via Encrypted Client Portal)
We commit to acknowledging reports within 24 hours and keeping researchers updated during triage.