Trust & Security
How we handle what you share.
Executive search runs on trust. This page describes the controls actually enabled on sercxi.io today — authentication, hosting, subprocessors, retention, privacy requests and accessibility — and points to the authoritative legal documents. Maintained by HR Agterhuis Management Beheer B.V., trading as Sercxi
This is a factual description of app-visible controls, not an independent certification or audit report. Where a claim requires evidence (SOC 2, ISO 27001, penetration test reports), we will state so explicitly or leave it out.
In plain English
- What you tell us about a search stays between you and the partner handling it.
- We do not run a candidate database, a CV portal or an application form.
- We only keep what a mandate needs, and you can ask us to see or delete your data at any time.
- The detail below and the linked legal documents are the authoritative version.
Security controls
-
Data Encryption
HTTPS (TLS 1.2+) in transit · the website keeps no database of enquiries or candidates.
-
Access Controls
No public accounts or logins · enquiry forms are validated server-side and contain no client-side keys.
-
Cross-Border Compliance
GDPR (EU/NL) · PDPA (Singapore) · PDPL (UAE/KSA) · APPI (Japan) · PIPL (China outbound).
Authentication & access
No public accounts
sercxi.io has no visitor accounts, logins or admin views. Enquiry and research-signup forms are validated on the server before anything is sent; the browser never holds sending credentials.
Operator security
Proton Business Suite for partner communications
Partner email runs on Proton Mail Business with end-to-end and zero-access encryption on a Sercxi custom domain. Every partner account is protected by two-factor authentication (TOTP or hardware key); shared inboxes are prohibited.
Partner devices reach client-sensitive systems over Proton VPN with always-on and kill-switch enabled. Credentials and shared secrets live in Proton Pass; sensitive documents at rest with partners live in Proton Drive (client-side encrypted).
Data in transit & at rest
HTTPS; no website data store
All traffic to sercxi.io and to our backend endpoints is served over HTTPS (TLS 1.2+). Enquiry and research-signup details are not stored by the website: they are held in memory only long enough to be sent by email (via Resend) to Sercxi's own inbox. The website offers no gated downloads.
Candidate & client data
Written consent before any CV moves
We do not represent candidates to unnamed clients. No professional data or CV is shared without explicit, trackable written consent from the candidate.
Enquiry details are sent server-side after validation — the browser never sees or stores client-side API keys.
Candidate materials exchanged with partners travel over Proton Mail (end-to-end encrypted between Proton counterparties, TLS with zero-access encryption otherwise) and, where retained by a partner, are stored in Proton Drive with retention aligned to the Candidate Privacy Notice.
Perimeter hardening
HTTPS headers and form abuse controls
Responses from sercxi.io are served with HSTS, X-Content-Type-Options: nosniff and a strict-origin-when-cross-origin Referrer-Policy. Further headers, such as a Content-Security-Policy, are not claimed here until they are in place.
Public forms (enquiries and research signup) use server-side validation, a hidden anti-spam field and duplicate-submission protection. The website has no sign-up or passwords.
Website analytics
Cookieless, no cross-site profiling
We use Umami for aggregate analytics — no cookies, no persistent visitor IDs, no cross-site tracking. There is no consent banner because there is nothing to consent to.
Server logs are retained only for operational debugging and are not sold, shared or used for advertising.
Subprocessors
A short, named list — kept current
The full list of subprocessors that may process personal data on our behalf (hosting, database, email, CRM, analytics) is published and updated when it changes.
Retention & deletion
Purpose-bound retention windows
Candidate records are retained only for the durations described in the Candidate Privacy Notice and Master Terms. You can request access, correction or deletion of your data at any time.
Privacy requests
Access, correction, deletion, portability
GDPR (EU/NL), UK GDPR, PDPA (Singapore), PDPL (UAE/KSA), APPI (Japan) and PIPL (China outbound) rights are honoured. Requests are actioned within statutory windows.
Email hello@sercxi.io with the subject line "Privacy Request" — a partner reviews every request personally.
Accessibility
EAA-aligned, WCAG 2.1 AA target
sercxi.io targets WCAG 2.1 Level AA and aligns with the European Accessibility Act (Directive 2019/882). The current status, known limitations and remediation roadmap are published in full.
Vulnerability reporting
Confidential intake for security researchers
If you believe you have discovered a security issue affecting sercxi.io or our backend endpoints, email hello@sercxi.io with the subject line "Security Report". Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.
We commit to acknowledging good-faith reports within five working days.
What we do not claim
Honest boundaries
We do not currently hold SOC 2, ISO 27001 or PCI-DSS certifications, and we do not represent that we do. We do not run continuous third-party penetration testing.
Where those controls are relevant to your procurement process, we are happy to discuss the underlying platform's compliance posture and provide an NDA-scoped questionnaire on request.