Confidence starts with accountable access.

Company verification is the first gate

Signup collects a company website, corporate email, registration details and supporting company information. After confirming email, the owner verifies the company domain with a generated DNS TXT record, then sets up an authenticator and saves recovery codes before opening the dashboard. Invited teammates reuse the company domain verification. ORPECT administration reviews business identity separately; until that approval, the secured workspace can maintain its own permitted records but cannot search other companies’ histories. Reserved paid-plan benefits activate after successful domain and company approval.

Permission follows the purpose

Search requires an eligible company, appropriate user permissions, an enabled regional policy and authorization for the employment verification purpose. Unique verified identifiers are matched automatically using stored locations. Profile access, salary disclosure and contact disclosure have separate controls. Access can stop when authorization expires, sharing is withdrawn, a relevant identity changes or a record becomes restricted.

• A name, subscription, identifier or credit alone never grants access.
• Prior unlocks do not bypass current sharing restrictions.
• Previewing permitted results and unlocking a complete profile are different actions.

Security and access controls

The backend enforces permissions and validation independently of the interface. Security controls cover account access, company boundaries, sensitive records and administrative changes.

• Company-scoped data access and role checks protect tenant boundaries.
• Protected sessions, password hashing and authenticator checks guard privileged access.
• Network and account request limits, input validation and generic errors reduce abuse and information leakage.
• Secrets come from environment configuration. Sensitive stored artifacts and backups use configured encryption.
• Audit records capture accountable administrative and record changes.

Uploads follow their own controls

Employee photographs and company logos accept bounded JPEG, PNG and WebP inputs. The server validates and re-encodes them into metadata-free images and checks access on retrieval. Other documents use quarantine and scanning controls; unscanned files are unavailable for download. Upload acceptance does not make a document publicly accessible.

Identity matching is not identity proof

Identifiers are protected and shared responses use masked government details. Matching considers issuing country, identifier type and reviewed aliases. Secondary contacts can be stale or shared, so uncertain or conflicting evidence is routed for review. An exact match does not establish that every attached assertion is accurate or disclose a profile automatically.

Review and evidence quality

Platform administrators moderate employer reviews, factual non-joining remarks and eligible evidence. Pending moderation means the contribution is awaiting that review. Approved means it passed the applicable publication checks, not that ORPECT guarantees every statement is true.

• Performance reviews use five factors and a server-calculated star average.
• Non-joiners receive factual recruitment remarks, without ratings.
• Review edits return to moderation; disputed or restricted material is withheld from shared views.
• Salary evidence has its own status and authorization requirements.

Individuals have a route to challenge records

The public Privacy Center accepts requests. The subject portal uses a limited access flow and identity review before disclosing sensitive information. Cases can track corrections, disputes, withdrawal and other rights requests. A company’s private record and an authorized shared profile follow different disclosure rules.

Regional requirements and fair use

The first markets require separate review of employment checks, privacy rights, notices, authorization and local restrictions. US consumer-report rules can apply to employment background services, including authorization and adverse-action procedures. European and Indian privacy requirements need market-specific implementation. A product feature or admin approval is not a substitute for these obligations.

Service scope and assurance

Hosting, provider safeguards, retention, incident handling and regional requirements form part of the service governance process. Contact ORPECT for assurance information and service terms applicable to your organization. Assess product controls in the context of your intended use and region.

Protected support conversations

Support Center in the dashboard header connects the signed-in requester with ORPECT Support. Other company users cannot read that requester’s tickets, including company owners. Platform support administrators require verified accounts and a recent authenticator check. Private administrator notes are excluded from requester responses and notifications. The server checks access on every conversation request.

Report a security or access concern

Signed-in customers can use Support Center for account or access concerns. Use Contact if you cannot sign in, and the Privacy Center for information-access or correction concerns. Provide the affected page, time and a description without passwords, authenticator codes or raw government identifiers. This helps route your concern to the appropriate review process.