Security & Data Handling

PataAjira runs on a dedicated virtual server hosted in a European Union data centre. The application, database and file storage run in isolated containers on that server. Database and file storage are not exposed to the internet; only the web application and API are reachable, and only over HTTPS.

• Account details: name, email address, hashed password or Google sign-in identifier.
• Opportunities you save or track, your notes, checklists, reminders and status updates.
• Your CV, if you upload one, together with the text extracted from it for matching.
• Notification preferences and, if you connect it, a Google Calendar authorisation token.
• An audit trail of significant account actions, kept for security and support.

• All traffic is encrypted in transit with TLS certificates that renew automatically.
• Passwords are hashed with bcrypt and never stored in plain text.
• Sessions use short-lived access tokens and HTTP-only refresh cookies.
• API requests are rate limited to protect against abuse and credential stuffing.
• Server access is restricted to SSH key authentication; deployments run from a locked-down pipeline.
• Errors are monitored centrally so that incidents are detected quickly.

The database and uploaded files are backed up nightly and copies are retained for at least fourteen days, with an off-server copy for disaster recovery. Restores are tested before backups are relied upon. Planned maintenance is announced in advance where it affects availability.

• Hosting provider for the server infrastructure (European Union).
• Brevo for transactional email such as reminders and digests.
• OpenAI for parsing opportunity pages and CVs. Only the text needed for the task is sent, and it is not used to train models.
• Google, only if you choose to sign in with Google or connect Google Calendar.
• Sentry for error monitoring, which receives technical error details and no CV contents.

You can update your profile, replace or remove your CV, and disconnect Google Calendar from Settings at any time. To request a copy of your data or deletion of your account, email isaacmasinde2019@gmail.com from the address on your account. We respond within fourteen days.

PataAjira is operated from Kenya and handles personal data in line with the Kenya Data Protection Act, 2019. Registration with the Office of the Data Protection Commissioner is in progress; institutional customers can request our data processing agreement.

If you believe you have found a vulnerability, email isaacmasinde2019@gmail.com with the details. We acknowledge reports within two working days and do not pursue action against good-faith researchers.