Security.

Authentication

Sign-in is handled by Firebase Authentication, supporting email and password, Google sign-in, and phone-based one-time passcodes. Passwords are never stored on our own servers.

Data in transit and at rest

All traffic to InstaHires is encrypted with HTTPS. Application data is stored in a managed, access-controlled database.

Access control

Every account has a single role — candidate, employer, or administrator — verified on our servers for every request. Administrator accounts can only be created by an existing administrator, never through public sign-up.

Payments

Payments are processed by Cashfree, a PCI-DSS compliant payment gateway. Card and bank details never touch InstaHires servers.

Keeping your account safe

• Never share your password or OTP with anyone — InstaHires staff will never ask for it.
• Use a strong, unique password and sign out on shared devices.
• Be wary of messages asking for money in exchange for a job. See our Fraud Alert.

Reporting a vulnerability

If you believe you've found a security issue, please email security@instahires.cloud with details — we take reports seriously and will respond promptly. Please give us reasonable time to fix the issue before disclosing it publicly.