For job seekers, in short
- Applying is always free. We never ask you for money, and a job that does is refused or taken down.
- Every listing is checked against our rules before it goes live. That is not a guarantee: check the company's own site before you share documents.
- Your CV is shown only to employers you apply to here, and to our team when needed to run the site. You can delete your account and its data at any time.
- Something looks wrong? Use “Report this job” on its page, and read how to spot a fake job.
Who we are
Work Remote Job (workremotejob.com) is run by Sequence Business Services Pte. Ltd. (Sequence SG), UEN 202346260R, 140 Robinson Road, #09-02, Tahir Building, Singapore 068907. For candidate data an employer receives through the site, the employer is the controller once it reaches them, and we process it on their behalf while it is held here. See the privacy policy for people using the site and the terms of service.
Security posture
- In transit. HTTPS only, with HSTS for the domain and its subdomains (two years). Every response carries a content security policy for framing,
X-Content-Type-Options: nosniff, a strict referrer policy and a permissions policy that turns off camera, microphone, location and payment APIs. - Accounts. Sign-in with Google or an email address and password; passwords are stored only as salted hashes. Employer accounts must prove a work address by a link sent to it; personal mailboxes are not accepted. Sign-in and CV import are protected against automation (Turnstile and BotID).
- Candidate files. CVs live in a private storage bucket with no public access, and are served only to the candidate, to the employer whose job they applied to and, when needed to run the service, to our team.
- Operations. Scheduled jobs run only with a secret token held outside the code; the review console has its own staff sign-in. The database is in one region. Our own nightly backups are not running yet; our database provider keeps a short restore history of its own.
- Monitoring. A public status page shows whether scheduled work ran; a check turns stale after 36 hours without a successful run.
- What we do not have. We hold no SOC 2 report or ISO 27001 certificate of our own; the attestations below are our providers'. There is no EU data residency, no single sign-on, SCIM or second factor for employer accounts yet. We say so on questionnaires rather than round up.
Subprocessors
Companies that process data for us, what for, and where. Attestations are as each provider publishes them on the linked page; check there for the current list. Changes to this table are posted here, with the date at the top of the page updated; the DPA draft adds notice by email to employers who sign it.
| Provider | Purpose | Region | Attestations (theirs) |
|---|---|---|---|
| Vercel | Hosting, serverless functions, cron jobs, cookieless visit counts and page speed (Web Analytics, Speed Insights), bot check (BotID) | Functions in the United States (Vercel's default region); static files served from Vercel's global network | SOC 2 Type 2, ISO 27001 |
| Neon | Postgres database: accounts, jobs, applications, employer data | United States, one region. No other residency is offered | SOC 2 Type 2, ISO 27001 |
| Cloudflare | Private object storage for CV files (R2), encrypted database backups (R2), and the “verify you are human” check (Turnstile) | Cloudflare's network; buckets are private with no public access | SOC 2 Type II, ISO 27001 |
| Stripe | Payments, invoices, tax calculation, membership billing. We never see full card numbers | United States and the regions Stripe operates in | PCI DSS Level 1 |
| Resend | Transactional email: sign-in links, verification, review outcomes, receipts, job alerts | United States | SOC 2 Type II |
| Anthropic | AI reading of job postings, and of CVs and profiles candidates choose to import, to pick out skills and experience | United States | SOC 2 Type II, ISO 27001 |
| “Continue with Google” sign-in; Google Analytics only when a visitor allows cookies | Global | ISO 27001, SOC 2 |
Singapore has no EU adequacy decision, so transfers from the EU or UK rely on standard contractual clauses (Module 2, controller to processor) in the data processing agreement below, and transfers out of Singapore follow section 26 of the PDPA.
How long we keep data
These periods are enforced by a daily clean-up job, not by hand.
- Applications sent through the site (name, contact details, note, CV copy, profile snapshot, team notes and ratings): deleted 365 days after the job closes. A candidate who withdraws has their copy deleted at once; the employer keeps an anonymous “withdrawn” row.
- A candidate's own CV file: while the account exists and until they delete it; deleted after 24 months without a sign-in. A CV uploaded but never confirmed is deleted after one day.
- Accounts: deleted at once on request from the account page, together with CVs, applications and preferences. Payment records stay, without the account, for as long as tax and accounting law requires.
- Job alert send logs: 90 days. Payment event ids: 30 days. Visit counts (no direct identifiers): 13 months. Scheduled-job logs: 90 days.
- Backups: Our own nightly backups are not running yet; our database provider keeps a short restore history of its own.
Job review and removal
- Jobs read from companies' own careers sites are checked by automated rules and an AI review (Anthropic, above) against our posting rules; no person reads each one before it goes live.
- A person reads every new company that posts here and its first jobs. We aim to answer within 24 hours of a job being sent; that is an aim, not a guarantee, and measured times appear on for employers once there are enough decisions. Our queue marks a batch overdue after 20 hours. Jobs asking applicants for money, paying in crypto or gift cards, or discriminating are refused before they reach the queue.
- Visitors can report any live job. 3 different reporters, at least one signed in, pause the job at once until a person reads it. An upheld report counts against the company's standing; a dismissed one puts the job back unchanged. Reporters stay anonymous to the employer.
- Employers are contacted by email only, from Work Remote Job, with replies to support@workremotejob.com. Support has no response-time commitment yet; we answer in the order received.
If something goes wrong
If a breach affects personal data we hold for an employer or a candidate, we tell the affected employers and people within 72 hours of confirming it, with what happened, what data was involved and what we are doing, and we notify authorities where the law requires it. Security researchers can reach us at support@workremotejob.com; see security.txt.
Privacy contact
Sequence Business Services Pte. Ltd., 140 Robinson Road, #09-02, Tahir Building, Singapore 068907. Email support@workremotejob.com. Data Protection Officer: Ivan, reachable at support@workremotejob.com. We answer access, deletion and correction requests within 30 days, or within 72 hours where the law sets that.
Data Processing Agreement
Draft v1, available on request, under legal review. Not yet signed with any employer and not a certification of any kind. It sets out Article 28 GDPR processor terms, incorporates the EU standard contractual clauses (Module 2) and the UK addendum for transfers, a PDPA section 26 transfer clause, the subprocessor list above, and a 72-hour breach notice to the employer.
We send it as a document to read with your counsel. We will sign a DPA once our own review is complete; we will not describe it as signed or final before then.
See also: status page, privacy policy, terms of service, for employers.