SecurityThe problem: thousands of people's bank details in your care
You hold National Insurance numbers, bank details and right to work evidence for thousands of people. This page says how TalentCore protects them, in plain words, with the limits written down.
Talk to us Start at the front door
Sign in
Priya, recruiterPassword accepted
Enter the 6-digit code from your authenticator app.
✓ Signed in. New device, so an alert was sent.
Screens are drawn from the real product with made-up data.
Getting inThe problem: one reused password opens everything
Five layers stand at the front door. Each one is a setting your own administrators control, and none of them asks a recruiter for more than a few seconds.
Staff add a six-digit code from any standard authenticator app. Eight one-time backup codes cover a lost phone. A device can be remembered, so the code is not asked for at every sign-in on the same desk.
Two-Factor Authentication
Authentication Code
Remember this device
VerifyAn optional "Sign in with Microsoft" button uses your Microsoft 365 work accounts. A Microsoft account does not create a TalentCore user by itself: only people who already have an account can use it. Password sign-in keeps working alongside.
Sign in
Sign in with MicrosoftSam, recruiter. Has a TalentCore account. Signed in.
Sign in
Sign in with MicrosoftA guest account. No TalentCore user, so no way in. Nothing was created.
Minimum length and how many old passwords are remembered are settings. Every new password is also checked against a public list of passwords known from breaches. Only the first five characters of a hash are sent, so the password itself never leaves the server.
Choose a new password
Repeated failed sign-ins pause the account and the address they came from. Keep going and the address is blocked automatically. The person sees a clear message saying how long to wait, not a mystery lockout. An administrator can clear a pause for an office that has simply mistyped.
| Who or where | State | |
|---|---|---|
| Unknown address | PausedBlocked | |
| Office address | PausedCleared by Jo | Clear |
Head office one address range
VPN one address range
On first sign-in, each user must read and sign two agreements in your company's name: the terms of use, and a data privacy and protection agreement. Raise the agreement version and everyone signs again. Who signed which version, when and from which address is recorded, and the signed copy can be opened as a PDF.
Before you continue
Recorded. Priya signed both on 11 November at 08:59. Version 2.0, with her address and browser.
Once insideThe problem: everyone can see everything
People see the tools for their job, in the branches they work in. Access grows by a recorded decision about one person, never by quietly widening a role.
Every sidebar link and every sensitive action sits behind its own permission, grouped into People, Operations, Finance, Insights and Admin. Seeing bank details, voiding a credit note or overriding a DBS block are separate permissions from the screens around them. The sidebar adapts, so nobody is shown a tool they cannot use.
| Permission | Recruiter | Branch manager | Admin | |
|---|---|---|---|---|
| People and Operations | ||||
| Workers | ||||
| Timesheets | ||||
| Finance | ||||
| Run and Approve Payroll | ||||
| View Worker Bank Details | ||||
Role names and ticks are an example. You decide both.
Each user has a home branch and can be given extra ones. Workers, clients, bookings and reports are filtered to those branches everywhere: on the desk, in the phone app, in the morning digest and in tenders. Branches and brands share one system without sharing data.
Recruiter
Someone who reaches a page they cannot open can request it there and then. Every administrator is notified and one approves. The grant goes on that person's record, never on their whole role. The master security permission can never be handed out this way.
You do not have access to Credit Notes
Ask an administrator. They will be told straight away.
Request accessRequested 10:14. Waiting for an administrator.
Access request: Credit NotesFrom Priya R. Sent to every administrator.
National Insurance numbers and bank details are encrypted at rest with AES-256, using a key kept outside the database. On screen they are masked. Revealing them needs the right permission and your password, and the reveal is written to the audit log. A stolen backup does not hand over the data fraudsters want most.
Reveal
Revealed for this view only.
WatchingThe problem: nobody reads the logs until it is too late
Sign-ins, exports, permission changes and API calls are all recorded. A scheduled monitor reads those records and turns the unusual ones into alerts, including attacks that never succeed.
Each sign-in is compared with that person's recent history. A sign-in from a device they have not used lately emails them at once, with the device, the time and the address, and tells them what to do if it was not them.
A new address, an unusual hour or a sudden change of address is recorded as an anomaly and emailed to your security contacts. Administrators see and acknowledge anomalies in Security.
New sign-in to your TalentCore account
If this was not you, change your password straight away and tell your administrator.
A background job reads sign-in attempts, the audit log, portal access and API requests, and raises alerts for review. Repeats are folded together so one incident is one alert. It works when nobody is signed in, and you can tune its thresholds. For administrators only, a separate risk view scores unusual staff activity such as out-of-hours access or unusually large exports.
Security lists active sessions with device, browser and address. An administrator can end one session or all of a user's sessions, phones included. Sessions time out when idle, and a session whose fingerprint changes is ended. An emergency lockdown ends everything for one user and blocks sign-in.
| User | Device | |
|---|---|---|
| Priya R. | Laptop, office | Live |
| Dom K. | Laptop, office | LiveEnded |
| Dom K. | iPhone app | LiveEnded |
| Dom K. | Tablet, home | LiveEnded |
Dom K. has left. Three sessions ended and sign-in blocked, by Jo M. at 17:02.
Creates, edits, deletions, sign-ins, exports and views of sensitive data are logged with the user, time, address and branch. The log is searchable and filterable, and reading it needs its own permission. It settles "who changed this?" in seconds, and it is the backbone of any investigation or client audit.
| Time | Action | Who |
|---|---|---|
| 08:41 | Permission granted | Jo M. |
| 09:06 | Export created: workers | Sam P. |
| 09:14 | Bank details revealed | Nia W. |
| 09:31 | Charge rate edited | Jo M. |
| 10:02 | Booking deleted | Sam P. |
The software watches the logs. A person decides what to do.Monitoring turns the unusual into an alert for review. Your administrators see it, judge it and act, and what they did is on the record too.
Nobody buys a platform for its upload folder. They do get asked about it. Here is what is in place before your team does anything.
Files are validated by type and by content and scanned for embedded scripts before they are kept. The upload folders cannot run code. Outlook message files are accepted as evidence.
CV, Dom K.
Type and content checkedStored
certificate
Script found insideRefused
Registration, portal sign-in and one-time links are protected by invisible bot traps and limits for each address. Fewer junk registrations for a recruiter to clear.
Registration
A person, onceAccepted
Registration
Hidden field filled inBot
Administrators can check the running application against a known baseline, and are told if anything has changed outside a release.
File integrityMatch
Running code against the release baseline
Pages are served over HTTPS with browser protections against cross-site scripting and click-jacking. When something breaks, the user sees a plain message and the detail goes to a log.
Something went wrong
We have logged it. Please try again.
Error logdetail kept here
For recruiters
For business leaders
The numbers and standards behind this page. Each one is how the product behaves today.
Consent, erasure, the retention schedule, backups and uptime evidence.
Keys are scoped, hashed and logged, and failed calls feed the same monitor.
Microsoft sign-in, and signature checks on every incoming message.
A DBS override is its own permission, with a reason recorded.
Seeing bank details and approving a payroll run are separate permissions.
Single sign-on, the allow-list and the rest are switches, off until you choose.
Write to us and a person will write back. Bring the security questionnaire your client sent you. We would rather answer it line by line than hand you a brochure.