Security

Encryption in transit & at rest

All data is transmitted over TLS 1.3. Data at rest is encrypted with AES-256 on Supabase (PostgreSQL + pgcrypto).

Authentication & access control

Supabase Auth with email OTP verification. Row-Level Security (RLS) ensures users can only access their own data. Service-role keys are never exposed to the client.

Two-factor authentication (2FA)

Every account can enable TOTP-based two-factor authentication (Google Authenticator, Authy, etc.) from Settings. We strongly recommend it — it blocks sign-in even if your password is compromised.

Infrastructure

Hosted on Vercel (global edge network) and Supabase (EU region). Automatic DDoS protection. No shared infrastructure between tenants.

Minimal data collection

We collect only what is necessary to operate the service. No third-party analytics or tracking scripts. AI processing uses API calls — candidate data is not stored by AI providers.

AI transparency (EU AI Act)

AI features (CV matching, analysis) are assistive only — every hiring decision is made by a human. Candidates are informed when AI-assisted tools are used in the application process.

Incident response

In the event of a personal data breach, affected users and relevant supervisory authorities will be notified within 72 hours as required by GDPR Article 33.

Abuse & bot prevention

Signup and public forms are protected with hidden bot traps and IP-based rate limiting to block automated abuse — without adding friction (like CAPTCHAs) for real users.