Security

Hosting

This website is hosted on Vercel and stores only what a visitor gives it, a lead email from a magnet download, or a contact request. The First Shift application is a separate system: it runs on Google Cloud Run, with its database on Neon Postgres. Candidate and applicant data lives there, never on this website.

Data Handling

This site (firstshift.jobs) stores lead emails from tool downloads and contact-form requests, nothing else. The application (app.firstshift.jobs) stores everything you put into it, scoped to your agency’s account: jobs, applications, candidate records, notes and team activity.

Access

Access inside the application is controlled by team roles: owner, admin, member and viewer, so you decide who can see and change what. Sign-in is via Google, so there’s no separate password for anyone to lose.

AI Processing

Every application is read by third-party AI models to parse the resume, produce a fit score and flag what the applicant did or didn’t state. First Shift sends applications to OpenAI and to Google (Gemini) for this processing.

The AI reads what’s in front of it. It does not run a registry, background, TB or CPR check itself. It flags when an application doesn’t state one, so you know what to verify by hand.

Data Deletion

To delete your agency’s data, or a specific candidate’s record, email privacy@firstshift.jobs. We handle deletion requests by hand while the account self-service option is built.

Reporting a Vulnerability

Found a security issue? Email security@firstshift.jobs and we’ll respond as quickly as we can. First Shift does not currently hold any third-party security certifications.