Security & privacy
This page sets out what we do with your data, including the parts that are not finished yet. If your procurement team needs something that is not here, please ask.
Where your data is, and what leaves
The application, database and backups run in Australia. Even the fonts on this page are served from our own servers, so loading a referee's form does not send their browser anywhere else.
Files. Finished reports, agency logos and data exports are held in Laravel Cloud's object storage, which runs on Cloudflare R2 and is not tied to a single country.
Email. We send through Postmark, which is operated in the United States, so a name and an invitation link pass through it. Sending email that reliably reaches an inbox needs a specialist provider, and we have not found one hosted in Australia that does the job well enough.
AI features. Three features send text to Anthropic in the United States, which does not use it for training: the help chat for signed-in users, call note drafting if you switch it on, and CV reading in PresentWell.
That is the complete list.
One agency cannot see another's candidates
There are two separate protections. The application limits every query to the signed-in agency. Underneath that, the database itself refuses to return another agency's rows, so a mistake in our code still gets nothing. A connection with no agency attached reads nothing at all.
We test it by switching the database protection off and running the whole test suite. The tests that read across agencies fail every time, which shows the two layers work independently. The build also fails if anyone adds a table of agency data without a matching policy.
Consent comes before the answers
A referee is told what is collected before anything is stored. That includes the time and IP address of their submission, and why we record them. It is on the screen above the button, not in a policy they will not read, which is what the Privacy Act and the Australian Privacy Principles expect.
Referee links are protected like passwords
Referee links are stored only as a one-way hash, so a copy of our database gives nobody a working link. They expire after fourteen days and are revoked as soon as a referee is removed or a request is cancelled. Invalid, expired, revoked and used links all return the same page, so nobody can learn anything by trying them.
Names and answers are encrypted in the database
The encryption covers the individual fields as well as the disk. Candidate and referee names, email addresses, phone numbers and free text answers are each encrypted, so a stolen backup is not a readable list of candidates and their former managers.
Two-factor sign-in is mandatory for owners
It is mandatory for owners and directors and optional for consultants. An account that has not set it up can reach the set-up screen and nothing else. Passwords are hashed with Argon2id, and changing a password signs out every other device.
A full audit trail
The log records who requested a reference, who sent it, who read it, and who downloaded a report and when. The database only allows entries to be added, so the log cannot be edited or deleted, including by us. You can read it and export it.
Reporting a security problem
If you think you have found a security problem in CheckedWell, email security@checkedwell.com and tell us what you found and how to reproduce it. A person reads every report. We will reply within two working days and keep you updated until it is fixed. Please give us a reasonable chance to fix it before you tell anyone else, and do not access anybody else's data to prove the point.
What we have not done yet
We are not ISO 27001 or SOC 2 certified. CheckedWell is a new product and we are not going to pretend otherwise. There is no penetration test report to send you yet either. If your procurement process needs those, please tell us.
Our Content Security Policy also allows unsafe-eval for scripts, because
the framework our forms are built with needs it. It is not a vulnerability on its
own, but it is a protection we would rather have at full strength, and removing it
is on our list.
Getting your data out, or deleting it
You can export your data on every plan. You can also delete your organisation, which removes everything, including references, answers and files. You set the retention period. The default is seven years, because that is what most Australian employers are required to keep.