Your workforce data, handled with restraint.
JobRoute Companies analyzes cohorts, not individuals. We de-identify employee records before we store them, strip personal data from every response, and keep only what the analysis genuinely needs. This page describes exactly how, and what we are still building.
De-identified by default.
Employee identifiers are de-identified before they are stored
Every external employee ID is hashed with HMAC-SHA256, keyed by a server-side secret and namespaced to your tenant, before it ever reaches the database. The raw employee ID is never persisted. Manager references are hashed the same way, so the org chart is preserved without storing a single raw identifier.
We do not store names, emails, or other personal details
The roster record we keep is deliberately minimal: a de-identified ID hash, the role title, department, tenure, seniority band, and location. There is no column for an employee name, email address, date of birth, or compensation figure. The data we hold cannot be traced back to a named individual on its own.
Personal data is stripped from every API response
The insights and cohort endpoints project only anonymized, role-level fields: role, department, tenure, seniority, archetype, and the four readiness pillar scores. No identifier hash, no name, and no raw record ever leaves the API to the browser. Analysis is performed on cohorts, not on identifiable people.
Connector credentials are used once and never stored
When you connect a Workday or SuccessFactors source, the credentials you provide are used in-memory for that single ingestion and are then discarded. There is no connector-credential table in our database. We hold no standing copy of your HRIS secrets.
Hardened infrastructure.
Connectors are guarded against server-side request forgery
Outbound connector requests are validated before every fetch. We block requests to private, loopback, link-local, and cloud-metadata address ranges, re-resolve and re-check the host on each call to defeat DNS rebinding, and refuse to follow HTTP redirects. A connector URL can only ever reach a legitimate, public HRIS endpoint.
Encryption in transit and at rest
All traffic to the application and to connector endpoints is HTTPS, and HTTPS is enforced for connector URLs in production. Data at rest lives in a managed Azure Database for PostgreSQL instance, which encrypts stored data by default using Microsoft-managed keys.
Strict per-tenant isolation
Every query is scoped to your tenant. One company can never read another company’s roster, scores, or cohorts. Authentication is passwordless: a single-use magic link issues a signed, httpOnly, secure session cookie that is scoped to this application.
Hosting
JobRoute Companies runs on Microsoft Azure in the United States. The application API runs on Azure Container Apps and the database on Azure Database for PostgreSQL. We are happy to confirm the specific datacenter region in writing for your security review.
Your data, your terms.
You control the data, and it is yours to remove
Your roster is held as snapshots tied to your tenant. When your account is closed, deleting the tenant cascades to every related record: employees, snapshots, scores, and role mappings are all removed. To request a data export or deletion before then, contact us and we will action it.
Grounded in public data, not a black box
Readiness scores are computed deterministically from public labor-market sources (the Anthropic Economic Index, O*NET, BLS, and the WEF Future of Jobs report) applied to your anonymized roles. The same input always produces the same result, and every figure is cited on the Methodology page.
What we have not done yet.
We would rather tell you what we are still working toward than imply a maturity we have not reached. As of today:
- A formal SOC 2 examination. We are not yet certified and do not claim to be. We can share our security practices in detail under NDA in the meantime.
- Self-service data export and deletion in the product UI. Today these are handled on request through support.
- Server-side session revocation. Sessions currently expire on a fixed schedule rather than being individually revocable.
Questions from your security team?
We are glad to walk through any of this in detail, share documentation under NDA, or confirm specifics in writing for your review.