Written for the person who has to approve it.

One organization cannot see another

Every record in the system carries the identifier of the organization that owns it, and every database policy checks that identifier first — before it checks anything else, and regardless of how the query arrived. Isolation does not depend on a query joining through the right table, because that is the kind of assumption that holds until someone writes a new query.

Access to the application is separately gated: holding a sign-in does not grant entry. An account must be explicitly entitled to Your Talent Pipeline and attached to a place in an organization's structure before it sees any data at all.

Permissions are enforced where the data is

Rules about who can see which people, and which categories of information about them, are enforced by row-level security policies in the database. The interface reads the same rules so that it can show the right controls, but it is not the thing enforcing them — a request that asked for data outside a viewer's scope does not return the data and get it hidden. It does not return it.

• Per-category. Information about a person is grouped into categories, each with its own view and edit permission. Flight-risk assessments are a category of their own, deliberately, because their sensitivity is different in kind.
• Per-depth. A permission set states how far down the structure a person can see from their own position. Peers in different regions do not see each other's people.
• Self-exclusion. Your own record never appears in your own lists, counts, charts or search results.
• Privilege ceiling. Nobody can grant an access level they do not themselves hold.
• Verified, not asserted. The rules exist twice — in the database and in the client — and a shared set of test cases is run against both, so the two cannot quietly disagree.

Signing in

Sign-in is handled by one shared account system operated by GroupWork LLC across its applications, so a person who already has a GroupWork account uses the same credentials here. Passwords are handled by the authentication provider and are never stored by us in a readable form. Access to each application is granted separately, and data in one application is not reachable from another.

Signing in does not by itself reach any organization’s data. An account sees a pipeline only once it is attached to a place in that organization’s structure — normally by an administrator’s invitation — and that administrator can withdraw it at any time.

Encryption

All traffic between a browser or device and our services runs over HTTPS (TLS), and the domain is served with HTTP Strict Transport Security so a downgrade to plain HTTP is refused by the browser. Data at rest — the database, uploaded photos, uploaded assessment documents and their backups — is encrypted by the underlying providers using AES-256.

Photos and assessment documents are never served from a public address. Each view or download is a short-lived signed link, minted only after the request is re-checked against the requester's permissions.

Where the data lives

Data is stored in the United States. The full list, with what each provider receives, is in the Privacy Policy.

A record of what changed

Edits are recorded with the account that made them, the time, and which fields changed. For the sensitive categories the log deliberately stores the field names and not the values: the audit trail is readable by anyone entitled to that category, and putting old readiness ratings or retention-risk notes into it would make it a second copy of the very data those category permissions exist to protect. Changes to a person’s name, level and employee identifier do record the previous value, because identity is what makes the rest of the record findable.

The record survives the deletion of the individual it refers to, because an accountability record that disappears with its subject is not an accountability record.

Read access is not currently logged — only changes are. If your policy requires recording who opened a record, ask us; it is not in place today.

Removal, restoration and deletion

An organization's data belongs to that organization. Removing a person from the pipeline takes them out of every view immediately and moves the record to an archived list an administrator can restore from — a mis-tap should not be unrecoverable. Promotion statistics are kept as counts after the individual record is gone, so a location's history is not rewritten by staff turnover. On request we delete or return an organization's data when the relationship ends.

Backups are the honest exception. A nightly database backup is kept for 30 days, and beyond that one snapshot per calendar month is retained indefinitely for disaster recovery. A record deleted from the live database still exists in snapshots taken before the deletion. Backups are used only to rebuild the whole database after a loss, never to serve the application.

No advertising, no cross-site tracking

We do not sell data, we do not share it for advertising, and we run no advertising or cross-site tracking technology in the application. The application does not embed third-party scripts. Sentry receives technical error reports only.

For IT and network administrators

Your Talent Pipeline is a business web application. If your organization filters outbound traffic through a secure web gateway or proxy, these are the hostnames it uses. There is no certificate pinning, so TLS inspection can stay enabled.

A single wildcard entry for *.yourtalentpipeline.com covers the first two and any future host.

If live updates do not arrive and data only appears after a manual refresh, the inspection engine is interrupting the WebSocket upgrade to the Supabase host. Allow that host to bypass TLS inspection; it does not need to be blocked or specially permitted otherwise.

If the domain is blocked as uncategorized, it is a business software-as-a-service site. The nearest categories are Business and Economy, Professional Services, or Information Technology / Computer and Internet Information, depending on your vendor's taxonomy. We are happy to answer a categorization request directly — questions@groupwork.cloud.

If there is an incident

If we become aware of a security incident affecting personal data we hold, we notify the affected customer organization without undue delay and within 72 hours of becoming aware — with what happened, what data is involved, what we are doing, and what we suggest you do. The first notification does not wait on a finished investigation. Full wording is in the Privacy Policy.

Reporting a security problem

If you believe you have found a vulnerability, email questions@groupwork.cloud with enough detail to reproduce it. We will acknowledge it, and we will not pursue anyone who reports a genuine finding in good faith and does not access, alter or retain other people's data while doing so. A machine-readable copy of this contact is published at /.well-known/security.txt.

What we do not claim

Your Talent Pipeline does not hold SOC 2, ISO 27001, or any other formal security certification, and we will not claim one we have not earned. This page describes controls that are actually implemented; if a control is not listed here, assume it is not in place and ask. This page is updated when that changes.

See also the Privacy Policy and Terms of Service.