Trust
Security at Global Remote Connect
How we protect your data. Last updated: Jul 1, 2026
Encryption everywhere
All traffic to and from Global Remote Connect is encrypted in transit with TLS 1.2+. Data at rest — including resumes, messages and profile data — is encrypted using AES-256.
Access control
Role-based access control, single sign-on for internal tools, and mandatory hardware-key multi-factor authentication for engineers and support staff with production access.
Compliance posture
We maintain a SOC 2 Type II report renewed annually and align our controls with ISO 27001. Reports are available to enterprise employers under NDA.
Penetration testing
Independent penetration tests are run twice a year by a third-party security firm, plus continuous automated vulnerability scanning of our infrastructure and dependencies.
Data residency
Primary data is hosted in US-based data centers, with regional processing options for Canadian and UK employer data to help satisfy local data-handling expectations.
Incident response
A documented incident response plan with 24/7 on-call coverage. Confirmed incidents affecting personal data are disclosed to affected users and regulators within legally required timeframes, and no later than 72 hours where required.
Vulnerability disclosure program
We welcome reports from security researchers acting in good faith. If you believe you've found a security vulnerability in Global Remote Connect, please email security@globalremoteconnect.com with a description of the issue, steps to reproduce, and any proof-of-concept code. We aim to acknowledge reports within 2 business days and provide a resolution timeline within 10 business days.
In scope
- *.globalremoteconnect.com production applications
- Authentication, authorization and session handling
- Data exposure and injection vulnerabilities
Out of scope
- Denial-of-service testing
- Social engineering of staff or users
- Third-party services we don't control
We do not pursue legal action against researchers who follow this policy in good faith and avoid privacy violations, service degradation, or data destruction.
Trust checklist
- TLS 1.2+ enforced on every endpoint, HSTS enabled
- AES-256 encryption at rest for all stored personal data
- Mandatory MFA for all staff with production or customer-data access
- SOC 2 Type II report renewed annually
- Controls aligned to ISO 27001
- Bi-annual third-party penetration tests
- Continuous automated vulnerability scanning
- Documented, tested incident response plan
- Public vulnerability disclosure program
- Regional data handling for US, Canadian and UK employers
Questions about our security practices? Contact support@globalremoteconnect.com.