Security

Encryption in transit & at rest

All data is transmitted over TLS 1.3. Data at rest is encrypted with AES-256 on Supabase (PostgreSQL + pgcrypto).

Authentication & access control

Supabase Auth with email OTP verification. Row-Level Security (RLS) ensures users can only access their own data. Service-role keys are never exposed to the client.

Infrastructure

Hosted on Vercel (global edge network) and Supabase (EU region). Automatic DDoS protection. No shared infrastructure between tenants.

Minimal data collection

We collect only what is necessary to operate the service. No third-party analytics or tracking scripts. AI processing uses API calls — candidate data is not stored by AI providers.

Incident response

In the event of a personal data breach, affected users and relevant supervisory authorities will be notified within 72 hours as required by GDPR Article 33.