Security

The simplest way to protect information is not to collect more than we need. We ask only for what it takes to scope a role and reach you, keep it with a small number of established providers, and limit access to the people on our team who need it.

This page explains how that works on our website, with the candidate information we share, and when our professionals join your team. For what we collect and why, see our Privacy Policy.

• Encrypted connections. Every page and form submission travels over HTTPS.
• Protected hosting. The site runs on Cloudflare's global network, which absorbs denial-of-service attacks and malicious traffic before it reaches us.
• Minimal third-party code. Our fonts and images are served from our own site, and we run no analytics or advertising scripts. The only outside script is the spam check on our forms.
• Nothing to steal at login. The website has no accounts or passwords, and it never asks for payment card details.

Our profile request and contact forms are protected by Cloudflare Turnstile, which tells people from bots without puzzles. Behind the scenes:

• our server confirms every check with Cloudflare before accepting a submission, and each check can be used only once, only for the form it was issued for and only on our domain;
• every field is validated again on our server, whatever the browser sends;
• the keys and settings that file submissions stay on our server and never reach your browser.

Form submissions are filed in Google Forms and Google Sheets, and intro calls are booked through Google Calendar. Google and Cloudflare both run independently audited security programs and encrypt data in transit. Inside MatchPoint, access to this information is limited to the team members working with you.

When we present candidates, we share only what you need to evaluate them for your role: profiles, assessment results, work samples, recorded introductions and references. Our Terms of Service require you to keep that information confidential, limit it to the people involved in the hiring decision and delete it when it is no longer needed. We ask the same care of ourselves with your company's information.

Every professional we place is vetted through skills assessments, live work samples and reference checks with past managers before you meet them.

Confidentiality and ownership of their work are set out in your Service Agreement: under our standard terms, the professional's work belongs to you from day one, and they must keep your confidential information confidential.

You stay in control of access. Professionals work in the tools and accounts you give them, so your existing security controls, policies and monitoring apply to them as they do to the rest of your team.

Security works best as a shared effort. When a professional joins your team, we suggest:

• giving them their own named accounts rather than shared logins;
• turning on multi-factor authentication for every account they use;
• granting only the access their role needs, and widening it as trust builds;
• sharing any necessary credentials through a password manager, never by chat or email;
• removing access on their last day, and letting us know as soon as an engagement is ending.

If you believe you have found a vulnerability in our website, or that information we hold has been exposed, please send us a message with the details and steps to reproduce it. We will acknowledge your report, look into it promptly and keep you updated.

Please give us reasonable time to fix an issue before disclosing it publicly, and do not access or change other people's information, disrupt the website or attempt social engineering while testing.

Have a question about security before you hire? Send us a message or book a call with our team.