Security

Last updated 13 October 2026

This page describes security practices we can verify in the ApplyDesk product and hosting setup. It is not a certification, penetration-test report, or uptime guarantee.

Authentication and access

Staff sign in with Discord OAuth (Auth.js). Applicant Discord login, when enabled, is scoped to that community portal. Ops/admin tools require authenticated platform staff with server-side permission checks. Workspace actions check membership roles (owner, admin, reviewer, viewer) on the server.

Secrets and payments

API secrets and database URLs live in the host environment (for example Vercel env vars), not in the client bundle. Card data is handled by Stripe Checkout and the Stripe customer portal — ApplyDesk stores Stripe customer and subscription identifiers, not full card numbers.

Transport and tenancy

Public traffic uses HTTPS. Community portals are isolated by hostname (platform subdomain or custom domain). Session cookies for staff and applicants are HttpOnly where the product sets them.

Data and deletions

Application answers and files are stored for the workspace that collected them. Owners can export and delete workspaces from the dashboard. Staff can export account data, erase their application submissions, and delete accounts from Account settings. Anyone can use the data request form. Operational metadata (for example product events and Discord action logs) is pruned on a schedule as described in the privacy policy. Host database backups follow the database provider's rotation — we do not invent a separate backup SLA here.

Discord bot

The bot only receives the permissions and events needed for the features a workspace enables (for example role assignment and channel notifications). Discord can revoke the bot; related features then stop. Communities remain responsible for how they use role grants and DMs.

Dependencies and monitoring

The app runs on third-party infrastructure (hosting, database, email, payments, Discord). We rely on those providers' security programmes and update application dependencies through normal engineering practice. We do not publish a fabricated uptime percentage or claim certifications we have not obtained.

Incidents

Suspected security issues: email support@applydesk.net or use support. Internally we follow a short incident-response procedure (containment, investigation, recovery, and assessment of any personal-data notification duties under current ICO guidance).

Privacy · DPA · Availability and support

These pages describe how ApplyDesk works. They are not legal advice. We may update them when the product or the law changes.