Security

Naseej Consulting uses authenticated, role-based workspace access. Users see the areas appropriate to their approved role rather than a shared public control panel.

Sensitive profile documents are stored privately with access controls. The application does not place private resume contents or similar documents into publicly readable pages.

Important operational workflows use approval states, audit-oriented records, and human review. Automated recommendations are not a substitute for a responsible person’s decision.

Each company works in its own workspace. Requisitions, candidates shared with that company, engagements and invoices are scoped to the workspace, and agencies see only the requisitions an employer has chosen to share with them.

API keys are created in Company Workspace → Developers and are used server-side, never in the browser. Webhook deliveries carry a timestamped Naseej-Signature header signed with HMAC-SHA256 so the receiving system can verify them, and the read-only REST API is limited to 60 requests per minute for each key.

If you believe your account or workspace access may be compromised, sign out of other sessions where available, reset your credentials through the sign-in provider, and contact your Naseej Consulting representative promptly.