Current controls are a starting point for your security review—not a certification, deployment assurance or permission to upload sensitive information.
Source review dated : repository threat model, authentication middleware, application headers, auth, data, market and coach routes. These findings describe code, not an independent penetration test.
Implemented controls / residual limits
What the current boundaries do.
Identity & trusted assignment
Bearer tokens are verified with an explicit allowed algorithm. Passwords use bcrypt. Missing signing-key configuration prevents startup. Registration rejects self-selected agency and role assignments; new accounts are unassigned viewers. Current account, role and agency membership are re-read for each authenticated request.
Limit: trusted operators provision membership. SSO and email verification are not established. An MFA flag exists but MFA is not enforced. Individual stolen-token revocation is not implemented; account deletion or reassignment is checked on subsequent requests.
Agency scope & roles
Scoped routes reject missing or invalid agency assignments and cross-agency selection, including for admins. Candidate writes require analyst/admin access and check referenced agency ownership. Viewers cannot use those write routes. Individual risk scoring is disabled.
Limit: platform ownership does not grant tenant-content access. Database grants require separate review. Application role, title or membership does not establish appointing, budget or delegated legal authority.
Browser & request boundaries
Helmet supplies security headers and a content-security policy. The application does not grant wildcard cross-origin API access. CSV parsing checks required headers, numeric values and upload limits; SQL values use bound values.
Limit: these controls do not establish an exhaustive injection audit. Imports may partially succeed after database write failures. Hosting TLS, encryption at rest, residency and backup behavior need deployment verification.
Throttles & external services
Authentication uses process-local IP/email budgets. Scoring, market and coach routes also apply request budgets. External provider keys remain server-side; market and coach routes require authentication.
Limit: budgets reset on restart and are not shared across instances. BLS, USAJOBS and Perplexity may fail or reach quotas. Coach output and external text are untrusted; source citations do not make generated advice correct.
Documents, sharing and memory · implemented in code
Storage is not content approval.
Reconciled against document routes, file inspection helpers, position-case routes and coach memory code on . These controls are not independently accepted.
Versioned document storage
Attachments are stored as PostgreSQL bytea with agency and case scope, version links, source metadata and a SHA-256 digest. Authenticated downloads use attachment disposition and no-sniff headers. Earlier versions remain available to authorized users.
Inspection boundary: size, allowed extension, basic PDF/Office file signatures and UTF-8 text checks only. No malware scan, macro inspection, full document-format validation, sensitive-content screening or OCR is performed. A digest identifies bytes; it does not certify safe content.
Text extraction is available only for TXT, MD and CSV, with a bounded excerpt. PDF, DOCX and XLSX contents are not extracted. Do not assume the coach read an attachment merely because it was uploaded.
Expiring, revocable sharing
Public links serve only a council one-pager stored as an immutable snapshot at a reviewed version. Creation requires the current case version and explicit acknowledgment of the selected projection. Later case edits do not alter the published snapshot.
Public share links contain randomly generated tokens; only SHA-256 digests of those tokens are stored. The server compares token digests before serving the stored snapshot. Expired or revoked links return HTTP 410; unknown or malformed links return HTTP 404.
Disclosure boundary: anyone holding a valid public link can open that council snapshot without signing in. Position and HR/finance audiences require sign-in and agency access; they do not receive public bearer links. Council projection excludes private free text records and person-level fields. The shared route does not serve attachment bytes. Sharing is a separate disclosure decision, not permission inferred from an internal confirmation.
Access counts are not proof of recipient identity, understanding or message delivery. Review the brief and audience before sharing, and revoke public links when no longer needed.
Consent-controlled coach memory
Memory defaults off and is scoped to the user and agency. Users can view, correct, export and delete their memories. Enabling memory permits saves and reuse; a coach-proposed memory requires explicit user confirmation. Current-case orientation uses the last remembered coach-viewed version.
Retention boundary: disabling memory does not delete it. Memories persist until deleted; coach history remains for traceability. Memory consent is not a general deletion control for case records, documents or coach history.
Memory is labeled user-stated and unverified. Document excerpts are blocked from provider requests by default. The agency's separate excerpt permission must be enabled before extracted text can be sent, independently of memory consent. Coach responses disclose the excerpt policy and whether AI was used. Approved purpose and provider terms are still required.
Confirmation and change controls
Case edits and record writes check the expected version. Confirmation and outcome records require a typed name, write permission and an active delegation for that action, including for admins. Admins manage scoped delegation records with a source reference, effective date, optional expiry and revocation. Owner and backup assignments route work, not authority.
The state machine supports explicit submission for review, return with a reason, superseding corrections and authorized reopening. Case records append rather than overwrite; writes create audit entries.
Authority boundary: recording a delegation reference is not independent verification of its legal validity. The authenticated verify endpoint reports the latest confirmation, not legal signature certification. Append-only application records do not establish administrator-proof storage or independent acceptance.
Excluded by design intent
What we never ask for.
Do not submit SSNs, medical or psychological detail, investigative findings, criminal history, student or client records, or unneeded candidate contact details.
A hiring-step status is not permission to hold criminal justice information. Exclusions apply equally to CSV cells, free text, document excerpts and coach questions. They are handling boundaries, not a claim that automated detection blocks every prohibited upload.
Provisioning and reporting · implemented controls
Separate account access from reporting access.
Reviewed : src/routes/provision.js, src/routes/reporting.js and docs/reporting-powerbi.md. Source inspection is not independent security acceptance.
Owner-only provisioning
The agency provisioning console requires a platform owner whose current owner assignment is rechecked against the database. It creates real agencies, initial admins, agency accounts and source-referenced delegations, with write auditing. Platform ownership does not itself grant agency-content access.
Provisioning does not verify employment, legal delegation or an agency's approval to use the service. Trusted operators must establish those facts separately.
Revocable reporting credentials
Agency admins issue reporting tokens scoped to their assigned agency. The raw token is shown once; only its SHA-256 digest is stored. Reporting reads accept the reporting token, not a session credential. Optional expiry and immediate revocation are implemented; omitted expiry means no scheduled expiration.
Reporting has a process-local request budget. Protect the raw token in an approved credential store, use an expiry and rotate it. Do not place it in URLs or shared workbooks: Power BI query definitions can expose manually supplied Authorization headers.
Aggregation is not anonymity
Check-in reports contain aggregate groups, not candidate rows or flag text, but no minimum-group suppression is applied. Small groups may be sensitive. Referral identifiers and pilot unit keys also require access review.
Revocation blocks future API reads; it cannot remove previously downloaded or cached reports. Retention, workbook permissions and Power BI workspace access remain agency responsibilities.
Source review remains necessary
Workforce measures, pilot estimates and imported OEWS wages carry source and date information. Source labels and uncertainty values supplied by an agency are not independent verification. Pilot recording does not establish causal effectiveness, and wage import does not establish permission to make a pay decision.
Power BI connection instructions are available, not evidence of a tested Service refresh or secure tenant configuration. Validate both Desktop and Service behavior before operational reporting.
Questions for security, counsel and the agency sponsor
Unresolved before production approval.
Hosting & provider terms
Where do agency records, backups and provider requests reside?
Who can access infrastructure, rotate keys and restore data?
Which information may be sent to Perplexity under approved terms?
Are shared abuse budgets and deployment monitoring configured?
Retention & incident response
What retention schedule, legal-hold and deletion rules apply to records and coach traces?
Who approves public sharing and reviews audience-specific disclosure?
Who receives incident reports, preserves evidence and notifies the agency?
Which restore, isolation and accessibility checks must be independently accepted?
No general retention/deletion guarantee, incident-response service level, independent security approval or procurement readiness is claimed. Resolve these requirements with authorized owners before collecting sensitive agency information.
This public page has no incident-reporting address configured. Do not post credentials or personnel records here; use your organization's established security escalation channel.
Review applicability, not badges
References for your review.
Texas DIR: TX-RAMP eligibility and requirements is an applicability-review reference. Publication/update date not verified; reference reviewed . Counsel must determine scope. Staff Sustain does not claim TX-RAMP certification.
DOJ web accessibility rule fact sheet, dated , is an accessibility-review reference. Check current applicability and deadlines with counsel. This page does not establish conformance or legal compliance.
No CJIS compliance, MFA enforcement, security certification or production acceptance claim is made.
Make review part of the evaluation.
Agree data boundaries, authority, provider terms and evidence requirements before a real agency case enters the workflow.