Security

Encryption

HTTPS/TLS for all traffic (HSTS). In production, the database and file storage are encrypted at rest.

Private documents

Uploaded resumes are never publicly accessible. Downloads require your session and use short-lived signed links.

Account protection

Argon2id password hashing, passkeys, authenticator-app two-factor authentication, rate limiting, temporary lockout after repeated failures, secure HttpOnly cookies and CSRF protection.

Payments

Card details are entered on Stripe’s hosted pages. We never see or store full card numbers or CVV codes.

Least privilege

Role-based access control; administrators must use two-factor authentication and their actions are recorded in an audit log.

Secure processing

Upload type verification, size limits, active-content checks and a malware-scanning hook; URL imports are protected against server-side request forgery.

Your control

Export your data or delete resumes, application history or your account at any time.

Found a vulnerability? Please contact the security address on our production domain (to be configured by the owner).