CSRF
A session-bound token prevents another website from submitting a form on the visitor’s behalf.
PRIVACY AND SECURITYPROTECT THE DATA.
PROTECT THE DATA.
VERIFY THE CHANNEL.
This page explains what the forms collect, how the server processes submissions and what information should never be sent.
PUBLIC FORM PROTECTION
MULTIPLE LAYERS — ONE PURPOSE
One-time form token
The token has a limited lifetime, includes a minimum fill time and is consumed after successful submission.
Rate limiting
Repeated submissions from the same pseudonymous client identity are limited within a time window.
Server validation
Required fields, lengths, formats, allowed values and consent are checked again on the server.
Encrypted storage
Applications and enquiries are encrypted at rest with a 256-bit key using sodium secretbox or AES-256-GCM fallback.
Minimal email notification
When enabled, email contains only the reference number, category and time — no personal data.
WHAT IS COLLECTED
ONLY WHAT THE FORM EXPLAINS
Candidate application
- Selected vacancy or open direction
- Name and contact details
- Experience, qualifications and motivation
- Consent confirmations and submission time
General enquiry
- Topic, name and organisation
- Reply address and message
- Consent confirmation and submission time
NEVER SEND
SENSITIVE INFORMATION DOES NOT BELONG IN A PUBLIC FORM
×Passwords and access codes
×Banking details
×Exact sensitive locations or routes
×Third-party personal data
×Copies of identity documents
×Information you are not authorised to disclose
PRODUCTION SETUP
WHAT THE ADMINISTRATOR MUST CONFIGURE
AEMB_FORM_KEYA base64-encoded 32-byte encryption key stored in the server environment, not in source control.
AEMB_STORAGE_PATHAn absolute path outside the public web root for encrypted submissions and audit records.
AEMB_RECRUITING_EMAILOptional address for non-sensitive notifications that a new encrypted submission exists.
HTTPSTLS must be enabled for all public pages and forms.
SOMETHING LOOKS SUSPICIOUS?STOP AND VERIFY
Official contact →