Password rules, session settings and sign-on for the platform, and a record of which protections are not yet in place.
Security Overview
Authentication
Authentication Controls & Session Security Policy
Password rules, session settings and single sign-on. Anything marked in red is not yet configured.
Password Complexity & Storage
Minimum Password Length
8 characters
Cryptographic Hashing
Managed by Supabase Auth
Breached Password Guard
Not enabled
Session Lifetimes & Expiration
Absolute Session Max
Not configured
Idle Inactivity Timeout
Not configured
Admin Concurrent Limits
Not limited
Account Lockout & Shield
Max Failed Attempts
Not configured
Temporary Lock Duration
Not configured
Automated IP Throttle
Not configured
Enterprise Single Sign-On (SSO)
Google Workspace OIDC
Not connected
Microsoft Entra ID (Azure)
Not connected
Custom SAML 2.0 Identity Provider
Not available
Security posture
What is actually in place today, and what is not yet configured. Only verified items are listed here.
Hosting & Network
• Frontend served by WeWeb over HTTPS
• Database and authentication hosted on Supabase, reached over TLS
• Platform media stored in the project's own AWS S3 bucket via the quick-handler edge function
• Not yet in place: a web application firewall, DDoS filtering and IP throttling
Identity & Access
• Supabase Auth is the only authentication system, and it hashes and stores every password
• JobsAIG never stores, logs or transmits a password in plain text
• Minimum password length of 8 characters, at sign-up and at reset
• Every account is identified by its Supabase user id, never by an email, name or role sent from the browser
• Not yet in place: multi-factor authentication, breached-password checking and account lockout
Data Access & Compliance
• Row Level Security in the database decides what each account can read and write — the browser is never trusted to enforce it
• Super admin access is checked by a database function, not by a flag held in the browser
• Payment and entitlement functions are restricted to the service role and cannot be called from a browser session
• No compliance certification has been obtained. Nothing here is SOC 2 or ISO 27001 certified