Security

At 296 Group, protecting your agency's data is a core priority. Opportunity Hunter CRM handles sensitive information — candidate documents, passports and payments — so we apply industry-standard security practices across the platform.

• In transit: All data is transmitted over encrypted HTTPS/TLS connections
• At rest: Data is stored on encrypted cloud infrastructure (Supabase, backed by AES-256 encryption)

• Passwords are stored as bcrypt hashes — never in plain text
• Multiple sign-in options, including email/password, Google and WhatsApp OTP
• Optional biometric / fingerprint login via the WebAuthn standard

Every agency operates in its own isolated tenant. Your candidates, payments and documents are logically separated so that no other agency can access your data.

• Role-based access for admins, staff, agents, candidates and employers
• Plan-based feature gating controlled from your admin panel
• Activity logging for an auditable trail of key actions

• Security response headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
• Per-IP rate limiting on sensitive endpoints
• Restricted CORS in production
• Parameterized database access to prevent injection

We support data-subject rights including access, correction and deletion. You can permanently delete your account and data from our Delete Account page. For details, see our Privacy Policy.

Security is an ongoing process. We continue to strengthen our controls over time. This page describes current measures and does not represent any specific certification.

If you believe you have found a security vulnerability, please report it to us privately so we can investigate and fix it. Do not publicly disclose the issue before we have had a chance to respond.