Concrete commitments — not marketing copy. Every item below maps to a platform capability that's already in production. We avoid legal guarantees because no software can make those, but we'll always point you to the underlying control.
Card data never touches our servers. Every payment is processed through Stripe's PCI-DSS Level 1 environment and submitted via Stripe Checkout — including Apple Pay and Google Pay wallets.
TLS 1.3 enforced via Kubernetes ingress on every request. Application data lives in MongoDB with encryption-at-rest on the underlying storage layer.
Payment transactions are retained for 7 years to comply with US federal and state tax law, even after an account is deleted. The rest of your data is purged on request.
Every job posted is run through a 50-state minimum-wage + tipped-wage + pay-transparency check. Below-floor offers prompt a confirmation before posting.
Any user can export every record we hold about them — or permanently delete their account — from Privacy & data rights without filing a ticket.
Authentication endpoints are rate-limited per IP so brute-force and credential-stuffing attempts hit a hard ceiling. AI features have separate budgets to prevent runaway spending.
Stripe webhooks are signature-verified before processing, and replayed events are detected via a unique-index guard — so a Stripe retry storm cannot double-credit a subscription.
Every compliance check, data export, and account deletion is recorded to an append-only log that admin operators can review when responding to regulator or labor-board inquiries.
The controls above are tools that help you run a compliant operation — they are not legal advice, an attestation report, or a guarantee. For audited compliance, ask us about SOC 2 + state-specific labor attestations on our roadmap, or have your counsel review your specific operations against your state's DOL guidance.