Sign in Create account Post a job
How it works

How it works

Two isolated account worlds, one WordPress user table, and a server-side permission check on every contact field.

My account
Permission model Access gates Unit map

Account separation & contact privacy

A deliberately small board: two isolated roles, one WordPress user table, and a server-side permission check on every contact field.

My account →
Job Seeker

Owns their contact data

  • Phone, WeChat and resume file are private by default
  • Cannot see other candidates' details - ever
  • Shares contact per application and can revoke it
  • May request admin-approved public publication
Employer / HR

Verified before access

  • Signup lands in pending verification, not the HR role
  • Admin approves the company before posting jobs
  • Sees a candidate's contact only after that candidate authorises the application, or after admin-approved publication
  • Never sees other employers' private HR contacts
Administrator

Sees and approves everything

  • Full contact list in a private wp-admin screen
  • Approves / rejects company verification
  • Approves / revokes public contact requests
  • Every view and every denial is written to an access log
  • Owns the policy switches: sharing, signup, verification, suspension
01 · Apply

Candidate applies for a job. The employer sees the name and application, but no contact details.

02 · Authorise

Candidate grants that specific application, or an administrator approves a public-profile request.

03 · Read + audit

Only then does the server return the contact fields. Access is logged; the candidate can revoke it.

Resume files are never public links

Uploads are checked by allowed format and size, stored in a private directory, emailed to the administrator's mailbox, and readable only through a permission-checked download that is logged every single time.

One administrator controls every permission

Six switches in wp-admin decide whether candidates may authorise a single application, request a public profile, whether employers may register or must be verified, and whether company contacts are visible. Turning one off takes effect on the server immediately - even for links already issued. All shares can be revoked and any account suspended in one click.

Admin only

Two independent gates, always on the server

Privacy is checked first, metering second. Neither can be skipped from the browser.

Membership levels →
Gate 1 · Privacy

Who may see this candidate?

  • The candidate authorises one application, or an administrator approves a public profile.
  • Employer HR contacts are never public and never shared between employers.
  • Job seekers never see each other. There is no public resume database.
  • The candidate can revoke an authorisation at any time.
Gate 2 · Metering

Has this employer paid for the look?

  • A monthly level quota or a single pass is charged per unlock.
  • The candidate's country has to be inside the level's scope.
  • Re-opening the same candidate for the same action is never charged twice.
  • Every unlock is written to the access ledger with the source of the allowance.
Why the order matters

Privacy first: a candidate authorises one application, or an administrator approves a public profile. Then metering: a monthly level quota or a single pass is charged. Employer HR contacts are never public, job seekers never see each other, and every unlock is logged. There is no public resume database and no online checkout - the administrator confirms settlement offline and activates the level. A paid level buys capacity, never consent.

Privacy first

One feature, one switchable unit

Small kernel plus independent units. Updating one never means editing another.

My account →
FoundationRequired foundation Theme supports, assets, menus and the shared front-end config bus.
Account rolesRequired roles The three isolated roles and every role predicate.
Privacy & access policyRequired policy Administrator policy switches, suspension and sign-in throttling.
Contact privacy & auditRequired privacy The permission gate, masking, grants and the access log.
Job listingsOn jobs Post types, taxonomies, field helpers and job cards.
Saved jobsOn saved-jobs Private per-member shortlist behind the Save button.
Private resume filesOn resumes Protected uploads, mailbox delivery and gated downloads.
Sign in & applicationsOn auth AJAX account endpoints, applications and the sign-in drawer.
Account dashboardOn account Role-separated dashboard, profile and posting tools.
Colours & copyOn appearance Skins, brand colours and every editable line of copy.
Right floating bar (admin-defined)On floating-ui The right-hand tool bar only.
Home page layoutOn front-page Hero, search, categories, job list, employers and CTA.
How it works pageOn how-it-works This page: permission model, access gates and the unit map.
Page copy & factory resetOn page-copy Editable page copy with a per-page factory reset.
Countries & regionsOn regions China / Overseas / Others, quota weights and minimum levels.
Membership & upgradesOn membership Levels, monthly contact / resume quotas and upgrade requests.
Single-use passesOn credits One contact or one resume read, with no subscription.
Access meteringOn access Second gate, unlock ledger and quota charging.
Company home pagesOn companies One public company profile per employer (/company/<slug>/, directory at /companies/), with an employer self-service editor, an administrator review queue and a job-to-company link. Never stores or displays HR contact details.
Job alertsOn job-alerts Saved searches with an optional weekly or daily e-mail digest of NEW matching vacancies, a one-click unsubscribe link in every message and a private management panel on the account page. Stores filters only - never a contact detail, never a profile.
How the units stay independent

Each unit owns their own authority

20 units 112 contracts 8 contact channels

20 units
Sign in Create account