Overview
This document describes the security model of the Firstwork platform — authentication mechanisms, access boundaries, data handling practices, and areas relevant to security assessments.1. Authentication
Supported Login Methods
| Method | Description |
|---|---|
| Email + Password | Traditional credential-based login |
| Email OTP | One-time password delivered via email |
| Phone OTP | One-time password delivered via SMS |
| Google OAuth | Single sign-on through Google |
| Dual OTP | Requires both email and phone verification |
| Magic Link | One-click authentication via emailed link |
| Invite Link | Registration through a pre-shared invitation URL |
Password Policy
| Requirement | Value |
|---|---|
| Minimum length | 8 characters |
| Maximum length | 64 characters |
| Uppercase letter | Required |
| Lowercase letter | Required |
| Digit | Required |
| Special character | Required |
Session Management
- Authentication is token-based (JWT)
- Sessions persist until explicit logout or token expiry
- Invalid sessions are terminated with redirection to the login page
- Conflict detection triggers automatic session refresh
CAPTCHA
Google reCAPTCHA can be enabled per company to protect login and registration forms from automated abuse.2. Access Control
Role-Based Access
The platform enforces strict role-based access control with four tiers:| Role | Access Scope |
|---|---|
| Applicant | Own applications, forms, and profile only |
| Worker | Own contract, documents, tasks, onboarding, and profile |
| Admin | All company data — hiring flows, applications, automations, settings |
| Platform Staff | Cross-company access to all platform management tools |
Company Data Isolation
Each company’s data is fully isolated. Admins see only their own company’s data. Platform staff can switch between companies but data is never mixed across tenants.Legal Entity Scoping
Resources within a company can be further scoped to specific legal entities, ensuring that subsidiaries or regional offices maintain independent configurations.User Impersonation
Platform staff can impersonate any user for support purposes. A visual indicator is displayed during impersonation. This capability can optionally be extended to admin-to-admin impersonation through a feature flag.3. User Input Surfaces
Form Submissions
The primary input surface. Candidates and workers submit data through multi-page forms that include:- Text fields (with optional regex validation)
- Email and phone fields (with format validation)
- Numeric fields (with min/max constraints)
- Selection fields (dropdowns, radio buttons, checkboxes)
- Date fields
- Rich text editors (for admin-created content)
- Free-text cancellation reasons (scheduler)
Rich Text Editors
Admins use rich text editors for:- AI Caller conversation scripts
- Email and SMS templates
- Course descriptions
- Form description elements
Code and Script Editors
Platform staff have access to:- A JavaScript editor for server-side scripts
- Custom Python function configuration in automations
- JSON editors for webhook request bodies
Search Fields
List views throughout the platform include search fields for filtering records. These are used across hiring flows, applications, automations, courses, and other entity lists.4. File Upload Surfaces
| Surface | Who Can Upload | File Types |
|---|---|---|
| Document upload (forms) | Applicants, Workers | Documents, images |
| Camera capture | Applicants | Photos (for document scanning) |
| Video capture | Applicants | Video (for identity verification) |
| Liveness check | Applicants | Camera capture (for face verification) |
| E-signature | Applicants, Workers | Canvas-drawn signature image |
| Profile avatar | All users | Image |
| Course cover image | Admins | Image |
| Company logo | Admins | Image |
| AI Caller avatar | Admins | Image |
| AI Agent file inputs | Admins (testing) | Any file type |
| Bulk import | Platform Staff | ZIP, CSV |
| Static files | Platform Staff | Any file type |
| Description media | Admins | Images, videos (for form content) |
5. External Communication Channels
Outgoing Communications
| Channel | Provider | Triggered By |
|---|---|---|
| SendGrid | Automations, system notifications | |
| SMS | Twilio, Plivo, Exotel | Automations, OTP delivery |
| Slack | Slack API | Automations |
| Phone calls | Plivo | AI Caller |
| Video meetings | Daily.co | Scheduler meet queues |
Outgoing HTTP Requests
| Surface | Description |
|---|---|
| Webhook automation action | Sends HTTP requests to arbitrary external URLs with configurable method, headers, body, and authentication |
| App integration actions | Custom integrations that make HTTP requests to configured endpoints |
| Background check services | Sterling API calls |
| Identity verification | Veriff API calls |
| Employment verification | E-Verify API calls |
| ATS synchronization | Fountain API calls |
| Spreadsheet operations | Google Sheets API |
Incoming HTTP Requests
| Surface | Description |
|---|---|
| Webhook triggers | External systems can invoke automations via unique webhook URLs |
| External API | Applications can be created via authenticated API calls |
6. Integration Credential Storage
| Integration | Credential Type |
|---|---|
| Sterling | Username and password |
| Veriff | API key and private key |
| Google services | OAuth 2.0 tokens |
| Hotjar | Tracking ID |
| Google Tag Manager | Container ID |
7. Admin-Level Sensitive Operations
| Operation | Description |
|---|---|
| Creating admin accounts | New admins receive full company access |
| Generating API keys | Creates credentials for external API access |
| Configuring integrations | Stores third-party credentials |
| Building automations | Can trigger webhooks, execute code, send messages, and modify data |
| Managing compliance rules | Controls candidate progression and decision logic |
| Viewing applications | Accesses candidate personal information and documents |
| Exporting billing data | Accesses financial and usage data |
| Custom Python functions | Server-side code execution via automations |
8. Platform Staff Sensitive Operations
| Operation | Description |
|---|---|
| User impersonation | Assumes the identity of any platform user |
| Feature flag management | Controls which capabilities are available per company |
| Script execution | Runs arbitrary JavaScript on the server |
| Company creation | Creates new tenant environments |
| Global template management | Creates resources accessible across all companies |
| Bulk data import | Injects application data from files |
| Demo account creation | Creates companies with sample users and data |
| Static file hosting | Uploads files accessible via URL |
9. Publicly Accessible Pages
The following pages are accessible without authentication:| Page | Data Visible |
|---|---|
| Job posting | Job title, salary, location, description |
| Login | Company branding |
| Registration | Company branding, job reference |
| Password reset | None |
| Auth landing | Company branding |
10. Third-Party Services
The platform integrates with the following external services that process user data:| Service | Purpose | Data Shared |
|---|---|---|
| Sentry | Error monitoring and session replay | Error context, user identifiers, session data |
| Microsoft Clarity | User behavior analytics | User identifiers, company context, page interactions |
| Daily.co | Video conferencing | Audio/video streams during meetings |
| Plivo | Telephony | Phone numbers, voice data during AI calls |
| Deel | Payroll | Embedded third-party interface |
11. Data Validation
| Layer | Technology | Scope |
|---|---|---|
| Client-side schema validation | Schema-based | All forms and configuration inputs |
| Field-level validation | Type-specific | Email format, phone format, password policy, numeric ranges |
| Custom regex validation | Admin-configured | Text fields with admin-defined patterns |
| Server-side validation | API-level | All data mutations |
12. Sensitive Data Categories
| Category | Examples |
|---|---|
| Personal Information | Names, emails, phone numbers, addresses |
| Identity Documents | Passports, IDs, work authorization documents |
| Biometric Data | Camera captures, liveness check images, e-signatures |
| Financial Data | Salary information, billing records |
| Authentication Credentials | Passwords, API keys, OAuth tokens, integration credentials |
| Location Data | GPS coordinates, addresses |