TroopBoard
Security overview
How TroopBoard protects its members’ data. Written in plain English; the full detail of what we collect and why lives in the Privacy Notice.
Access model
- Invitation-only membership
- Accounts exist only for invited members. Registration requires an admin-issued invitation code — codes can be bound to a single email address, are consumed atomically, and cannot be reused beyond their limit — and sign-in is checked against a server-side allow-list.
- Passwordless authentication
- There are no passwords to steal or reuse. Members sign in with one-time email links that expire and cannot be used twice.
- Server-verified sessions
- Every request to a protected page re-validates the session with the authentication provider rather than trusting the browser cookie.
Application security
- Row Level Security
- Database access is governed by row-level policies: members can only read and write their own records, and privileged operations run through locked-down, service-only functions.
- Hardened redirects and links
- Sign-in redirects are validated against open-redirect attacks, external job links are scheme-checked (http/https only) and always open with browser protections applied.
- No raw HTML rendering
- Third-party job content is rendered as plain text — never injected as HTML — which closes the classic job-board route to cross-site scripting.
- Abuse controls
- Sign-in and registration are rate-limited per address and per network origin, with failed attempts logged for review.
Platform & data
- UK/EU hosting
- The member database and authentication run in London (AWS eu-west-2); the ingest worker runs in an EU region. Traffic is encrypted in transit (TLS) and data is encrypted at rest.
- Data minimisation
- We store the minimum needed to run the service: your email, preferences and saved jobs. Analytics are cookieless and aggregated; there are no advertising trackers.
- Backups and retention
- Databases are backed up on a short rolling window, and retention periods for every category of data are published in the Privacy Notice.
Reporting a vulnerability
If you believe you have found a security issue in TroopBoard, please email support@thetruetroop.com with enough detail to reproduce it. We take every report seriously, will acknowledge it promptly, and ask that you give us a reasonable window to fix the issue before any public disclosure.