NoraHıreby Infinora Tech

Trust and safety

Security

How we protect accounts and hiring data on NoraHire, what you can do to stay safe, and how to report a security problem.

Security at NoraHire

People trust us with their careers and companies trust us with their hiring. We protect every account and every workspace as if it were our own, and we are open about how.

Accounts and passwords

  • Passwords must be at least 10 characters with a mix of letters, numbers and symbols.
  • We store passwords only as bcrypt hashes. Nobody at NoraHire can see your password.
  • Sign-in shows the same message for a wrong email and a wrong password, so accounts cannot be guessed.
  • Repeated failed sign-ins and reset requests are slowed down and then blocked for a while.
  • Two-step verification with an authenticator app is available for every account.
  • Password reset links work once and expire after 30 minutes.

Sign in with Google, Microsoft or LinkedIn

  • We use the standard OAuth 2.0 and OpenID Connect sign-in. Your password at those providers never reaches us.
  • Each sign-in carries a one-time state value tied to your browser, which blocks forged sign-in requests.
  • Accounts are matched on the provider's fixed account ID, not only on email.

Sessions

  • Your session is a signed token in an HttpOnly cookie that scripts cannot read.
  • Sessions expire after 8 hours, and end straight away when you sign out.
  • Every sign-in attempt, successful or not, is logged with its time, IP address and browser.

Company data stays separate

NoraHire runs many companies on one platform. Every request for company data is limited to the signed-in user's own workspace, and the code refuses queries that could cross into another workspace. We test this separation automatically.

Infrastructure

  • All traffic is encrypted with HTTPS.
  • Pages send security headers that stop other sites from framing NoraHire or guessing file types.
  • Uploaded logos are checked by their content, not only their file name, and are shown in a way that cannot run scripts.
  • Secrets such as database passwords and sign-in keys are kept out of the code.

Keeping your account safe

  • Use a password you do not use anywhere else, ideally from a password manager.
  • Turn on two-step verification.
  • We will never ask for your password by email, phone or chat.
  • Sign out on shared computers.

Report a security problem

If you think you have found a security problem in NoraHire, tell us from the Contact page and choose "Security report". Include the steps to reproduce it. Please do not access other people's data, change data or disrupt the service while testing, and give us reasonable time to fix the problem before you share it.

We will reply within 3 working days, keep you updated, and credit you if you wish.