SECURITY

Data Security & Privacy

How we protect your data at every layer.

Your Content

✓We never train on your content. Emails, resumes, and text you submit are analyzed and discarded. Only scores and metadata are stored.
✓No public directory. Your performance data is never listed in any public directory or search index.
✓Shareable reports use signed, expiring URLs with revocation controls. All views are audit-logged.

Infrastructure

✓Cloudflare edge network. All traffic is encrypted via TLS 1.3. Data is processed at the nearest edge location.
✓D1 database with encryption at rest. User data is stored in Cloudflare D1 with automatic backups.
✓No third-party analytics trackers. We use first-party analytics events only.

Access Controls

✓Session-based authentication with 7-day expiry.
✓Per-endpoint rate limiting to prevent abuse.
✓Admin routes require double-gate verification (auth + admin role).
✓Stripe webhook verification with signature validation and idempotent processing.
✓All admin actions are logged with actor ID, IP, and timestamp.

Your Rights

✓Data export: You can request a full export of your stored data.
✓Account deletion: Request complete account and data deletion at any time.
✓Report revocation: Revoke any shareable report link instantly.