Security, privacy and accessibility

The answers your IT review asks for

What a procurement or IT review asks first, answered in one place. Where the answer is a document, it is linked.

Sign-in

Single sign-on through your identity providerStudents, staff and institution administrators sign in through the university's identity provider, set up once at the institution level. OpenID Connect providers are supported: Microsoft Entra, Okta and Keycloak are in use at customers today, and Shibboleth connects through its OpenID Connect plugin.

No new passwords for studentsA student imported from your roster signs in with the university account they already have.

Permissions per career centerStaff accounts belong to one career center and carry permissions set there. Institution staff see across every career center on the campus.

Payments

Card payments on Stripe's own formWhen an employer pays a fair invoice by card, the card details are entered on Stripe's hosted payment form and never pass through Career Forge.

Campus payment systemsCareer centers that take payment through TouchNet, by check, or by other methods set those up on the career center, and each event chooses which to offer.

The ledger is yoursEvery registration raises an invoice; collected, outstanding and refund figures come from the invoices and the payments you record. Invoices and the financial overview export.

Your data

Each career center sees its own studentsA career center claims the students it imports. Where two centers on a campus serve the same students, the records are the same records, with one set of data per student.

Everything exportsReports download from the report builder, check-ins export from the event dashboard, survey data exports in full and in the NACE format, and submissions and postings are listed and downloadable. Nothing is locked in.

Student ID cardsThe kiosk reads a student ID with the iPad camera. During setup we ask for one sample card so the reader can be configured for your layout; a mock-up with the same layout is fine, and we will speak with your IT team about anything they want to check.

Calendar syncCoaches who connect Google or Microsoft calendars do so through Nylas, with a one-way option that sends Career Forge appointments out without reading the external calendar. The help centre states exactly what the connection can access.

Accessibility

A published VPATCareer Forge's Voluntary Product Accessibility Template reports how the product meets the criteria of Section 508 of the Rehabilitation Act. It is a public document, linked below.

The kioskStudents who cannot use the camera or an NFC card check in by typing their student ID or searching by name, and staff can check anyone in from the web.

The kiosk app

Updates are enforced when they matterWhen an app release changes how data is handled, the iPad app requires the update before it can be used again; other updates are offered, not forced.

Offline by designCheck-ins made without a connection are stored on the iPad and synced back to Career Forge by a staff member when it is online again.

Documents

Security questionnaires and the current documents go to your IT team as part of procurement; ask on the call.

Questions IT and procurement ask

Yes. Sign-on is set up once at the institution with your OpenID Connect identity provider; Microsoft Entra, Okta and Keycloak are in use at customers today, and Shibboleth connects through its OpenID Connect plugin. Students and staff then sign in with the accounts they already have.

No. Card payments are made on Stripe's hosted form. Career Forge records that an invoice was paid; the card details stay with Stripe.

Yes, from every module: reports download from the report builder, check-ins export from the event, survey responses export in full and as the NACE file, and lists across the staff portal download.

Yes, published and linked on this page. It reports conformance with the Section 508 criteria.

The career center that imported the student, and institution staff. Another career center on the same campus sees a student only if it also imported them.

Ask us. We answer security questionnaires as part of every procurement and will send the current documents to your IT team.

Used byCareer centers from a single college to a whole universitySee who, and what they say