Separate tenants, fine-grained permissions, sign-ins and changes on record.

Data and tenants

• Separate tenants

  Every tenant has its own subdomain. The application filters by tenant, and a filter in the ORM adds the tenant where a read query leaves it out. Row Level Security blocks access to the database that bypasses the application.

• No file runs as a page

  Only PDFs and pictures are shown, under a sandbox security policy; the application recognises them by their content, not by their file name. All other files come as a download, so no stored file runs as a page in the browser.

• Only approved data goes out

  Job ads and portals show approved fields only, without margin or billing data. A profile is published only with consent.

Access and sign-in

• Central sign-in

  With email, Google, Microsoft or GitHub, each can be switched off per tenant. The password rules are set by the platform.

• Second factor

  With an authenticator app, can be enforced for admins, with a grace period to set it up.

• Roles and permissions

  More than 100 individual permissions. Wage data has its own, portals only see their own data.

Logs

• Sign-ins and roles

  Sign-ins, failed attempts, password and role changes and invitations, with IP address and browser.

• History of records

  Candidates, jobs, companies and employees keep a history of their changes.

• Support sessions

  When our team works as a user in your tenant, every such session is logged with the real person.

Encryption and backups

• HTTPS only

  Connections run over HTTPS only, and the API sends HSTS.

• Credentials encrypted

  Alprion stores credentials for third-party systems encrypted, such as those for mail servers and webhooks.

• Backups

  Full and incremental backups, encrypted with AES-256 and with a signed manifest. A single tenant can be restored, with a dry run first.

Operations and providers

• Microsoft Azure

  Alprion runs on Microsoft Azure, and so do its database and files.

• AI through Azure OpenAI

  The AI features run through Azure OpenAI. They read and suggest; with the preview you check the job and the CV before saving.

• Payroll in SwissSalary 365

  Once the connection is set up for your tenant, hours, wage types and master data go to SwissSalary 365, and the posted payslip lines come back.

Interfaces and development

• Public API

  With API keys, scopes and limits per key. A repeated call is recognised by its key.

• Signed webhooks

  Outgoing webhooks are signed after Standard Webhooks (HMAC-SHA256), and their targets are checked against calls into the internal network.

• Checks on the code

  Dependencies and code are checked with osv-scanner, pip-audit, gitleaks, semgrep, bandit and Trivy.

This website

This website sets no cookies, loads nothing from third parties and does not count visits. The fonts come from our own server.