Information Security Management Policy

1. Purpose

Cubehire holds information that matters to two groups of people who have no way of checking on it themselves: engineers who have given us their identity documents, CV and a recorded interview, and companies who have told us what they are building and who they are hiring. This policy states how that information is protected, who is accountable for it, and what happens when something goes wrong.

2. Scope

This policy covers all information processed by Cubehire in the course of running the platform: candidate profiles and identity data, CV files, interview answers and recordings, client enquiries and contracts, and the systems and suppliers that hold any of it. It applies to every employee, contractor and supplier with access to those systems.

3. Objectives

• Confidentiality: information is available only to the people and systems that need it.
• Integrity: information is accurate, and changes to it are attributable.
• Availability: the platform and the data in it are there when they are needed.
• Accountability: every access to candidate data can be traced to an account.
• Compliance: we meet the data protection obligations that apply to the markets we operate in.

4. Responsibilities

Overall accountability for information security rests with Cubehire management, who approve this policy and review it at least annually. Day to day responsibility sits with the engineering team, who implement and monitor the controls. Every person with access to Cubehire systems is responsible for following this policy, and for reporting anything that looks wrong immediately rather than waiting to be certain.

5. Access control

• Access is granted on least privilege: the minimum needed for the role, and no more.
• Candidate contact details, identity numbers and interview recordings are restricted to the staff who review profiles and resolve appeals.
• Recruiter accounts are approved by hand before they can see profiles, and a recruiter never sees a candidate's contact details before the candidate agrees to talk.
• Administrative access is separate from ordinary staff access and is reviewed when someone changes role.
• Access is revoked on the day a person leaves or a contract ends.

6. Authentication and passwords

Passwords are stored using a one-way hash and are never recoverable in readable form, by us or by anyone else. Accounts that fail repeatedly are rate limited. Staff accounts on third-party systems that hold Cubehire data use multi-factor authentication wherever the supplier supports it.

7. Encryption and data handling

All traffic between a browser and the platform is encrypted in transit. Uploaded CVs, profile photographs and interview recordings are stored on access-controlled storage, separate from the public profile data, and are not served from a public directory. Data is not copied to personal devices, and production data is not used for testing.

8. Suppliers and sub-processors

Cubehire relies on third parties for hosting, storage, email and AI model processing. Each is assessed before use for its own security posture and its data protection terms, is given only the data the feature requires, and is bound to process it on our instructions alone. The list of processors and what each one receives is available to clients on request.

9. Monitoring and logging

Application and access logs are collected and retained so that an incident can be reconstructed. Interview sessions record their own integrity events, which is what makes a termination reviewable rather than a matter of anyone's word. Logs containing personal data are subject to the same retention limits as the data itself.

10. Incident response

A suspected security incident is reported to Cubehire management on discovery. The response is to contain it, establish what data was involved, fix the cause, and tell the people affected. Where a breach is likely to put someone at risk, the affected individuals and the relevant authority are notified without undue delay and within any statutory deadline that applies.

11. Business continuity

Platform data is backed up regularly and restoration is tested. In the event of an outage the priority is restoring the interview and profile systems, because a candidate part-way through an interview has the least ability to recover on their own.

12. Secure development

Changes to the platform are reviewed before release. Dependencies are kept current and known vulnerabilities in them are treated as defects to be fixed, not as risks to be accepted. Security testing by a client or a third party is welcome by arrangement and in writing.

13. Awareness

Everyone with access to Cubehire systems is briefed on this policy when they join and when it changes. Security is treated as part of doing the job properly rather than as a separate exercise.

14. Compliance and review

This policy is reviewed at least once a year, and sooner if the platform, the law or the risk picture changes materially. A breach of it by a member of staff or a contractor is treated as a disciplinary matter. Questions from clients about any control described here are answered by the address below.