Security & trust
Behavioural profiles and reporting structures are sensitive. This page describes the controls that actually exist in AlignEQ today — enforced in code and covered by tests — and is honest about what is still on the roadmap.
Nothing on this page is a certification claim. Roadmap items are labelled as such.
What protects your data
Each of these is implemented in the product and backed by automated tests — not a policy document.
Every query is scoped to the organization derived from the server-side session — never from a parameter the client controls. Cross-tenant access is tested for explicitly (including IDOR cases) so a regression fails the build, not a customer.
Permissions are checked server-side against the caller's role for each action. The platform super-admin is a separate, environment-configured identity, not a customer account with extra flags.
Passwords are hashed with bcrypt. Sessions are httpOnly, Secure, SameSite JWT cookies that carry a session version checked against the database on every request — so revoking access, or changing a password, invalidates every existing session immediately. Login attempts are rate-limited.
Sensitive actions — sign-ins, role changes, erasures, uploads, integration changes — are written to an organization-scoped audit log. Each entry is hash-chained to the one before it, so an edited or deleted record breaks the chain and is detectable.
AlignEQ scores behavioural fit, so that is what it stores: profiles, titles and reporting lines. We deliberately do not ingest compensation, health information, or government identifiers such as SSNs — from uploads or from HRIS integrations.
An employee record can be anonymized on request through a dedicated erasure path that strips personal data while preserving the org's aggregate history. The operation is scoped to the requesting organization and recorded in the audit log.
All traffic between your browser, the application and the database is encrypted in transit. Secrets are kept out of source control, and stored integration credentials use application-layer AES-256-GCM encryption rather than plaintext columns.
All code lives in version control. Access control, tenant scoping, session handling, audit-chain integrity, erasure and encryption each have their own automated test suites, and type-checking and tests gate every change.
How the product behaves
AlignEQ recommends; people decide. It never auto-actions a hiring, promotion or termination decision.
No black-box scores. A flagged misfit is deliberately rare and always explained from the underlying behavioural data.
When we don't have a profile or a measured signal, the product says so. We never imply data we don't hold.
Compliance
We would rather tell you exactly where we are than show you a badge. Here is the current state, plainly.
We are building toward a SOC 2 examination — mapping controls, collecting evidence, formalising policies. We are not yet SOC 2 certified and will not describe ourselves that way until an independent auditor says so.
A DPA covering our role as processor of your employee data.
Published to this page as they are finalised.
A current written summary of the controls above, for your vendor review.
If you believe you have found a vulnerability in AlignEQ, please tell us before anyone else. We will acknowledge your report and keep you informed through to resolution.
We will walk your team through the controls, share our current posture documentation, and answer your questionnaire directly.