Security

Metaintro is built on a foundation of trust. We protect the data of job seekers, enterprise clients, and partners by implementing industry-recognized security frameworks and privacy regulations across every layer of our platform.

Our Compliance Standards

ISO 27001

Information Security Management

Metaintro maintains an information security management system (ISMS) aligned with the ISO/IEC 27001 standard. We follow a systematic approach to managing sensitive information through defined risk management processes, security controls, and continuous improvement.

Formal risk assessment and treatment processes govern how we identify and mitigate threats
Security policies and procedures are documented, reviewed, and updated regularly
Access controls follow the principle of least privilege across all systems
Business continuity and incident response plans are tested and maintained
Employee security awareness training is conducted on an ongoing basis

SOC 2

Service Organization Controls

Metaintro adheres to the SOC 2 framework, evaluating our controls across the five trust service criteria: security, availability, processing integrity, confidentiality, and privacy — as defined by the American Institute of Certified Public Accountants (AICPA).

Infrastructure and application-level security controls are continuously monitored
System availability is maintained through redundant architecture and uptime monitoring
Data processing integrity is verified through automated checks and audit trails
Confidential information is encrypted in transit (TLS 1.2+) and at rest (AES-256)
Logical access to production systems is restricted, logged, and reviewed

HIPAA

Health Insurance Portability and Accountability Act

For clients in the healthcare sector, Metaintro implements safeguards consistent with HIPAA requirements to protect electronic Protected Health Information (ePHI). We maintain administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of any health-related data processed through our platform.

Administrative safeguards including workforce training, access management, and security incident procedures
Technical safeguards including unique user identification, automatic session timeouts, and audit logging
Data encryption for ePHI both in transit and at rest
Business Associate Agreements (BAAs) are available for enterprise clients who require them
Minimum necessary access principles are applied to any health-related data

GDPR

General Data Protection Regulation

Metaintro is committed to compliance with the European Union's General Data Protection Regulation. We respect the data rights of individuals in the European Economic Area and have implemented processes to uphold every right granted under the regulation.

Lawful basis: We process personal data only with a valid legal basis — consent, legitimate interest, or contractual necessity
Data subject rights: You can access, correct, delete, port, or restrict the processing of your personal data at any time
Data minimization: We collect only the data necessary for the stated purpose
Data Protection Officer: We maintain a designated point of contact for all privacy-related inquiries
International transfers: Any data transfers outside the EEA are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards
Breach notification: In the event of a qualifying data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay

CCPA

California Consumer Privacy Act

Metaintro complies with the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA). California residents are afforded specific rights over their personal information, and we honor every one of them.

Right to know: You can request a detailed account of the personal information we have collected about you and how it is used
Right to delete: You can request the deletion of your personal information, subject to limited legal exceptions
Right to opt out: We do not sell personal information. If this ever changes, you will have a clear mechanism to opt out
Right to non-discrimination: Exercising your privacy rights will never result in different pricing, service quality, or access levels
Data retention: We retain personal information only for as long as necessary to fulfill the purposes for which it was collected

Platform Security Practices

Beyond specific compliance frameworks, these security practices are applied across our entire platform:

Encryption: All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256.
Infrastructure: Our platform runs on hardened cloud infrastructure with network segmentation, firewalls, and intrusion detection systems.
Authentication: We support multi-factor authentication (MFA) and enforce strong password policies for all accounts.
Monitoring: Security events are collected, correlated, and monitored around the clock. Anomalous activity triggers automated alerts.
Vendor management: Third-party vendors and subprocessors are assessed for security posture before onboarding and reviewed periodically. See our Subprocessors page for more details.
Penetration testing: We conduct regular penetration tests and vulnerability assessments through qualified third parties.
Incident response: A documented incident response plan is in place with defined roles, communication protocols, and post-incident review processes.

Responsible Disclosure

We take the security of our platform and the protection of our users' data seriously. We welcome responsible vulnerability disclosures from security researchers and are committed to working with the security community to keep Metaintro secure.

If you discover a potential vulnerability, please disclose it to us responsibly before making it public so we can protect our users while we work on a fix.

How to Report a Vulnerability

Send your findings to security@metaintro.com and include:

A detailed description of the vulnerability
Steps to reproduce the issue
Any relevant proof-of-concept code or screenshots
The potential impact of the vulnerability

Please avoid any actions that could violate user privacy, destroy data, or disrupt our services during your investigation.

Our Commitment

We will respond to your report promptly
We will keep you informed of our progress
We will address confirmed vulnerabilities in a timely manner
We will recognize researchers who help us (with your permission)

Account Issues

If you are experiencing issues with your own account, please contact our Support Team instead of using the security disclosure process.

Questions?

If you have questions about our security practices or need documentation for your vendor review process, contact us at security@metaintro.com or reach out to your account representative.

We're grateful to all security researchers and partners who help keep Metaintro secure.