Security
Technical and organizational measures protecting IQNexus+ users and data. Last reviewed June 2026. This page describes app-visible controls and is not an independent certification.
Multi-factor authentication
- TOTP-based 2FA available to every user (Google Authenticator, 1Password, Authy).
- MFA required for all administrators.
- Per-user enrolled-factor management at /settings/security.
Encryption
- TLS 1.2+ enforced on every endpoint.
- AES-256 encryption at rest on managed Postgres and object storage.
- Secrets stored in a managed vault, never in source control.
Authentication & access control
- Email + password, Google, and Apple sign-in.
- Leaked-password checks against Have I Been Pwned at sign-up and password change.
- Role-based access: admin / recruiter / employer / candidate.
- Row-level security on every user-owned table; users cannot self-promote.
Audit logging
- All admin actions (role grants, content changes, user lookups) written to an immutable audit log.
- Per-user sign-in history accessible at /settings/security.
- Logs retained for at least 90 days.
Payment security
- Payments processed by Stripe and Razorpay; card data never touches our servers.
- Webhook payloads verified with HMAC signatures before processing.
- Subscriptions and one-time purchases tracked in immutable billing ledgers.
Vulnerability management
- Continuous dependency scanning and static analysis on every build.
- Security advisories triaged within 48 hours; critical fixes shipped same-day.
- Coordinated disclosure: email security@iqnexus.app and we'll acknowledge within 24 hours.
Report a vulnerability: security@iqnexus.app