Security Policy

You trust us with your account, your conversations and, for taskers, identity documents. This page describes what we actually do to protect them, and how to tell us if you find a problem.

Your account

• Passwords are never stored in readable form. They are hashed with bcrypt, so even our team cannot see them.
• You can sign in with Google. We never receive your Google password.
• Sign-up and contact forms are protected against automated abuse.
• Choose a password you don't use anywhere else, and never share it. Kerjakan staff will never ask for it.

Your data in transit and at rest

• The website, the apps and the API use encrypted HTTPS connections.
• Identity documents uploaded for tasker verification are kept privately. They are never published and can only be retrieved by you or by an administrator reviewing your application.
• Our service has no advertising or analytics trackers.

Your payments

• Payments are handled by Billplz, a third-party payment provider. Your card or bank details are entered with Billplz and your bank. They never reach, and are never stored on, Kerjakan's servers.
• See our Payment Policy for how money moves.

Keeping conversations safe

• Phone numbers, e-mail addresses and account numbers are hidden from messages before they are stored, so payment and contact details stay out of chat. This is a protection against scams.
• Administrators can read a conversation only to settle a dispute or investigate a report, and every such read is logged.
• You can report and block other users, and report a job or a message, from the app and the website.

Trust on the marketplace

• Taskers can apply for verification with an identity or business document. Verified taskers are marked on their profile.
• Reviews come from completed jobs, and every tasker builds a public rating.
• We can suspend accounts that break our Terms, including anyone who asks to be paid outside Kerjakan.

Spotting scams

• Pay only through Kerjakan. Anyone asking for cash up front, a bank transfer or a payment link outside the app is likely a scammer. Report them.
• Be wary of anyone who wants to move the conversation to another app straight away.
• Kerjakan will never ask for your password, a verification code or your bank login.

Reporting a security problem

If you believe you have found a vulnerability, or your account has been misused, please write to contact@kerjakan.my with the subject "Security", or use the Contact us page. Describe what you found and how to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing. We will acknowledge your report and keep you updated.