Security at ecareer.ai
Your CV, research history, and visa status are among the most sensitive documents you own. This page lists the protections we actually have in place today — no more, no less.
Encryption
- All connections are encrypted in transit (TLS), with HTTPS enforced across the service, and strict transport security (HSTS) applied.
- The database and file storage are encrypted at rest.
- Encrypted (SSL-enforced) connections are required at the database layer, and direct database network access is restricted.
Access control & data isolation
- Row-level security isolates every user's records in the database — one account cannot read another's data.
- Uploaded documents are stored in private buckets, accessible only through your own authenticated session via short-lived signed URLs.
- Administrative credentials are separated from the application and never exposed to the client.
Account & authentication
- Passwords must meet a minimum length and are screened against known breach databases (HIBP), so a password exposed in a past third-party breach cannot be used.
- Consent and security events are logged for auditability.
Abuse & attack surface
- User-supplied URL fetching (for job postings you add) is guarded against SSRF: scheme and hostname validation before any network request, with timeouts and response limits.
- Rate limiting protects analysis and AI endpoints against abuse.
- Security headers are applied service-wide, including HSTS, X-Frame-Options (DENY), and X-Content-Type-Options (nosniff).
Your data, your exit
- We do not use the content of your uploaded documents to train our own or third-party AI models.
- Deleting your account (Profile → Delete account) removes your database records and purges every uploaded file from storage. If the file purge cannot complete, deletion stops rather than leaving orphaned data — we treat an incomplete deletion as a failure.
What we don't claim
No internet service can guarantee absolute security, and we will not claim otherwise. If a breach ever affects your personal information, we will notify you and the relevant authorities without undue delay, and tell you plainly what happened, what data was involved, and what we are doing about it.
Responsible disclosure
If you find a vulnerability, we want to hear about it: security@ecareer.ai (also published at /.well-known/security.txt, RFC 9116). Please give us reasonable time to fix the issue before public disclosure — we read and answer every report.