Security, described without the gloss.

This is a product-level overview of controls implemented in Talon’s web application. It is not a security certification, a penetration-test report, a service-level agreement, or a statement about every supplier or deployment environment.

We do not use this page to claim encryption standards, regulatory certifications, multi-factor authentication, or infrastructure controls that are not evidenced by the application reviewed here. Customers should complete their own due diligence before putting personal data into a live service.

Talon’s application session and refresh tokens are set through server-side cookies. Those cookies are marked HttpOnly, use a SameSite=Lax policy, and are marked Secure when the application runs in production. This helps prevent browser scripts from reading those session cookies and reduces some cross-site request risks.

Users should still protect their credentials, use unique passwords, and remove access for people who no longer need a workspace. Talon supports password reset and password change flows; password strength validation requires at least eight characters with uppercase, lowercase, and numeric characters.

The web application sends a Content Security Policy that limits where pages may load scripts, frames, connections, media, and embedded objects from. It also sets frame-ancestor restrictions, blocks plugin objects, restricts form submission to the site itself, and upgrades insecure requests.

Additional response headers include X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, a strict-origin-when-cross-origin referrer policy, and a permissions policy that disables camera, microphone, and geolocation access. Production browser source maps are disabled.

Relevant Talon workspaces expose consent status, consent capture and expiry dates, retention windows, privacy requests, export packages, and privacy audit events. Recruiter privacy controls also include configurable retention and audit-retention settings, plus an option to automatically delete data when consent expires.

These features help customers run their own privacy processes. They do not transfer the customer’s legal, employment, or data-protection obligations to Talon. Read the privacy information for the product context.

The public Talon assistant endpoint accepts same-origin requests only, validates incoming payloads, and applies an in-process limit of 20 requests per client IP in a one-minute window. When the limit is reached, the route responds with a retry interval.

This is a targeted control for that public endpoint, not a claim that every API route has the same rate-limiting model or that the limit is shared across every application instance.

If you believe you have found a security issue, use the contact form and select “Security report.” Include a concise description, affected route or feature, and safe reproduction steps.

Please do not access, alter, exfiltrate, or disclose another person’s data while investigating. Do not include credentials, applicant records, access tokens, or other sensitive information in a general enquiry.