Security at MarketPadHQ

MarketPadHQ takes security seriously. We protect your data with industry-standard safeguards, so you can focus on growing your business.

1. Data Encryption

In transit: All traffic to and from our platform is encrypted using TLS 1.2 or higher. Your data is always protected while moving between your browser and our servers.

At rest: Sensitive fields — including the credentials and OAuth tokens for any service you connect — are encrypted using AES-256-GCM before they are stored.

2. Authentication & Access Control

Two-Factor Authentication (2FA): Every account can enable 2FA for an extra layer of security, using an authenticator app, email, or SMS. Marketers and headhunters are required to use it — an authenticator is set up as part of activating their account, and there is no way to sign in without one.

Strong password policy: We enforce a minimum of 10 characters and reject common and easily guessed passwords.

Role-based permissions: Access to data and features is controlled by user roles — Admin, Manager and Viewer — so people see and change only what their role allows.

Session control: You can see everywhere your account is signed in and end any session you do not recognise.

3. Infrastructure Security

Hosting: MarketPadHQ is hosted on DigitalOcean, with data centres in North America.

Firewalls & network security: Our servers are protected by firewalls, and only necessary ports are exposed to the internet.

Isolated environments: Production, staging and development environments are fully separated, each with its own database and its own credentials.

Regular backups: We take automated daily backups of all critical data so we can recover quickly in the event of an incident.

4. Monitoring & Logging

Audit logs: Every significant action — login attempts, password changes, user management and data access — is logged and retained.

Real-time monitoring: We actively monitor for suspicious activity, including failed login attempts and unusual access patterns.

Incident response: We have a documented incident response process to quickly contain and resolve any security issue.

5. Secure Software Development

Code reviews: Every change is reviewed before it is merged and deployed.

Automated testing: An automated end-to-end test suite runs against every release before it reaches production.

Dependency management: We regularly update third-party libraries to patch known vulnerabilities.

Security-aware development: Our team follows secure coding practices and uses tools to identify common security issues.

6. Third-Party Providers

We rely on trusted, industry-leading third-party providers to deliver our services:

• Stripe handles all payment processing (PCI DSS Level 1 certified). We never see or store full card numbers.
• SendGrid manages email delivery (SOC 2 compliant).
• DigitalOcean provides cloud hosting (SOC 2, ISO 27001).
• Google Cloud supports OAuth authentication (SOC 2, ISO 27001).
• Meta is used for advertising analytics (GDPR compliant).

The full list, and what each provider receives, is set out in our Third-Party Integrations Policy.

7. Compliance

GDPR: We are committed to GDPR compliance and provide a Data Processing Agreement upon request.

SOC 2: MarketPadHQ maintains SOC 2-aligned security practices.

Data retention: We retain customer data for 30 days after account cancellation, after which it is permanently deleted. Invoices are retained for 7 years for tax compliance.

8. Data Privacy

No data selling: We do not sell your data to third parties.

European data protection: We comply with GDPR requirements, including the right to access, rectify and delete personal data.

Privacy Policy: Our full Privacy Policy sets out what we collect and why.

9. Responsible Disclosure

If you discover a security vulnerability, please report it to us immediately at security@marketpadhq.com. We investigate all reports promptly and take them seriously.

10. Contact Us

If you have any questions about our security practices, contact us at security@marketpadhq.com.

MarketPadHQ Corp.
Toronto, Ontario, Canada