Security & Privacy
Legacy Job Ad Craft is an internal HR tool operated by Ascend HR Corp on behalf of Legacy Community Health. This page explains in plain language what data we handle, how we protect it, which third-party services are involved, and what rights you have.
Last updated: May 27, 2026
🛡
SOC 2-Aligned · GDPR-Informed
Controls are mapped to the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Privacy). This platform has not undergone a formal SOC 2 audit and does not claim legal GDPR compliance. Privacy practices are designed to align with GDPR principles including data minimization, purpose limitation, and user rights.
What data this tool handles
A plain-language summary of what is and is not collected.
✓Job posting content only. The platform stores job ad drafts: title, department, location, job description text, responsibilities, and qualifications. This is role-level information — not personal data about any individual.
✓No candidate data. This tool does not collect, store, or process candidate applications, resumes, CVs, or any personal information about job seekers. Candidates interact with JazzHR directly, not with this platform.
✓Uploaded documents are transient. When you upload a Word, PDF, or TXT file to import a job description, it is processed in server memory and immediately discarded. It is never written to disk or saved in the database.
✓User accounts. Recruiter accounts are limited to email address, hashed password, and role (admin / recruiter / hiring manager). No demographic or personal profile data is collected beyond what is required for authentication.
Encryption & Data Protection
How data is protected in transit and at rest.
✓All traffic is encrypted via HTTPS/TLS enforced by the hosting platform. HTTP connections are automatically redirected to HTTPS.
✓HSTS (Strict-Transport-Security) headers are set in production to prevent protocol downgrade attacks.
✓Data at rest is encrypted by the managed PostgreSQL database (Replit-hosted). Encryption key management is handled by the platform provider.
✓The JazzHR API key, OpenAI key, session secret, and all other credentials are stored as environment secrets — never hard-coded, logged, or exposed in source code.
●Customer-managed encryption keys (BYOK) and field-level encryption are not currently implemented — planned as a future enhancement.
Credential Handling
How passwords and access tokens are managed.
✓Passwords are hashed using scrypt with a random 16-byte salt and 64-byte derived key — a memory-hard algorithm designed to resist GPU brute-force attacks. Plain-text passwords are never stored or logged.
✓Session tokens are stored in httpOnly cookies (not accessible to JavaScript) with a 24-hour expiry.
✓Authentication is restricted to @legacycommunityhealth.org and @ascendhrcorp.com email domains. All other domains are rejected at the server before any account is created.
✓Microsoft OAuth (Azure AD) is supported as an SSO pathway, delegating credential management to Microsoft's identity platform.
⚠MFA is not yet enforced within the app. Admin and recruiter accounts should enable MFA via Azure AD Conditional Access as an operational control.
Third-Party Services & Integrations
External vendors this platform connects to and what data each receives.
| Vendor | Purpose | Data shared |
|---|
| OpenAI (via Replit AI) | AI parsing, categorization, and rewriting of job description text | Job description text only. No names, emails, or candidate data. |
| JazzHR | Publishing job postings to the ATS as draft records | Job ad content (title, description, location). No personal user data. |
| Vimeo | Embedding Legacy Community Health recruitment videos | No data sent. Videos are embedded as iframes (viewer's IP handled by Vimeo). |
| Google Sheets | Fetching the approved video list for the video library | No personal data. Read-only access to a public/shared spreadsheet. |
| Replit | Hosting platform, managed PostgreSQL, and AI API gateway | Platform processes all server traffic and stores the database. |
Access Control & Infrastructure
Role-based access, network controls, and security headers.
✓Role-based access control (RBAC) with three roles: Admin, Recruiter, and Hiring Manager. Server-side middleware enforces least-privilege on every route.
✓Security response headers are set on every server response: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (camera, microphone, geolocation, and payment all blocked), and Content-Security-Policy: frame-ancestors 'self' to prevent clickjacking.
✓File uploads are strictly validated: only the document field is accepted, MIME types are allowlisted (txt / doc / docx / pdf), and size is capped at 5 MB.
✓Structured audit log events are emitted for: job ad created, updated, deleted; document uploaded; JazzHR publish initiated. Each captures record ID, title, and client IP.
⚠No formal WAF, SAST/DAST pipeline, or external penetration test has been conducted. See Operational Gaps below.
Your Rights & How to Contact Us
What you can request and how to reach us.
Because this is an internal tool used only by Legacy Community Health and Ascend HR Corp staff, the personal data processed is limited to recruiter account credentials and job ad content. Nevertheless, you have the following rights with respect to your account data:
✓Access: You may request a summary of what account data is stored for your email address.
✓Correction: You may request correction of inaccurate account information.
✓Deletion: You may request deletion of your account and associated data. Note that job ad records created by your account may be retained per operational policy.
✓Contact: To exercise any of these rights, report a security concern, or ask questions about this policy, contact the Ascend HR Corp technical team through your Legacy Community Health IT coordinator or the Ascend HR support contact provided during onboarding.
This page is a good-faith disclosure of current practices, not a legally binding privacy policy. It will be updated as the platform evolves.
Incident Response
How security incidents are handled.
✓Security issues should be reported immediately to the Ascend HR Corp technical team and the Legacy Community Health CISO/IT Security contact.
⚠A formal written Incident Response Plan (IRP) with defined roles, escalation paths, and SLAs has not yet been documented.
⚠No tabletop exercise has been conducted to validate incident response procedures.
⚠ Remaining Operational Gaps
These items are not blocking for internal use but should be addressed before formal SOC 2 certification or broader rollout.
⚠Enforce MFA on all accounts — use Azure AD Conditional Access
⚠Confirm session cookie secure flag is true in production
⚠Implement persistent, tamper-evident log store (90-day minimum retention)
⚠Set up alerting on repeated failed logins and bulk deletes
⚠Perform an external penetration test (annual cadence)
⚠Integrate SAST/DAST and npm audit into a CI pipeline
⚠Define and document RTO/RPO; verify platform backup schedule
⚠Write and publish a formal Incident Response Plan
⚠Conduct annual tabletop incident response exercise
⚠Document a Data Retention and Deletion Policy for stored job ads
⚠Publish a formal privacy notice for platform users
Frequently Asked Questions
Does Legacy Job Ad Craft store candidate resumes or personal data?
No. The platform only stores job posting content (title, department, description, location). It does not collect, store, or process candidate applications, resumes, or any personal information about job seekers.
What happens to documents I upload?
Uploaded Word, PDF, and TXT files are processed in server memory for AI parsing and immediately discarded. They are never written to disk or retained in the database.
Is this platform SOC 2 certified?
No. The platform is designed to support SOC 2 readiness and maps controls to the SOC 2 Trust Services Criteria, but has not undergone a formal SOC 2 audit.
Who can access the platform?
Only users with @legacycommunityhealth.org or @ascendhrcorp.com email addresses. Other domains are rejected at authentication.
How do I request data deletion or report a security issue?
Contact the Ascend HR Corp technical team through your Legacy Community Health IT coordinator or the Ascend HR support contact provided during onboarding.