Data & Security
1. How We Store Your Data
Your documents are stored securely using Cloudflare R2 object storage with data encrypted at rest and in transit. Your profile data is stored in our database, protected by access controls, regular backups, and encrypted connections.
2. Document Security
- All file uploads are transmitted over HTTPS (TLS 1.2+)
- Documents are stored in Cloudflare R2 with access restricted to authenticated operations
- Our team does not access your documents unless required for support (with your consent) or compelled by law
- Files are validated before storage to prevent malicious uploads
- When you delete your account, all documents are permanently deleted within 30 days
3. Email Credential Security
Connected email account credentials receive the highest level of protection in our system:
- OAuth tokens are encrypted with AES-256-CBC before storage
- Tokens are decrypted only in server memory at the moment they are needed, and are never logged, cached, or written to files
- The encryption key is stored separately from the database
- Failed or revoked tokens are purged immediately
- All token operations happen over encrypted HTTPS connections to Google's and Microsoft's servers
4. Sensitive Information
- SA ID numbers — stored encrypted, used only for date-of-birth extraction and employment equity. Never shared with employers unless included in your CV.
- Identity documents — stored securely, shared only as part of authorised job applications.
- Disability status — optional, never disclosed without your consent.
- Email OAuth tokens — stored encrypted, used only for sending authorised application emails. Never shared with third parties.
5. What We Share with AI Providers
We send to AI providers: extracted CV text, structured profile data, job listing text, and profile summaries for composing email bodies.
We do not send: ID numbers, identity documents, passwords, authentication tokens, banking details, email OAuth credentials, actual document files, or the content of any emails in your inbox.
6. Payment Security
All payments are processed through PayFast, a PCI DSS Level 1 compliant gateway. SPAAN NOW never stores your credit card or banking details.
7. Security Measures
- HTTPS encryption on all pages and API endpoints
- Cloudflare DDoS protection and Web Application Firewall
- Password hashing using bcrypt
- AES-256-CBC encryption for OAuth tokens and sensitive credentials
- CSRF protection on all forms and API calls
- Rate limiting on authentication endpoints
- Session management with secure, HTTP-only cookies
8. Data Breach Protocol
In the event of a data breach, we will notify affected users within 72 hours as required by POPIA. If email credentials are affected, we will immediately invalidate all stored tokens and prompt affected users to reconnect. We will also notify the Information Regulator.
9. Contact Our Data Team
Email: legal@spaannow.co.za · Support: support@spaannow.co.za