🔒
TLS 1.2+ encryption
All data in transit
🗄️
AES-256 at rest
Encrypted storage
🚫
Zero data selling
Never sold or shared
🤖
No AI training use
Your data stays yours
Transport Security
All communication between your browser and CareerOS servers is encrypted using TLS 1.2 or higher. HTTPS is enforced on all endpoints — plain HTTP connections are automatically redirected. Our frontend is deployed on Vercel's global edge network, which provides automatic certificate management and HSTS headers.
Data at Rest
Your data is stored on Railway-hosted PostgreSQL databases with AES-256 encryption at rest. Database backups are encrypted with the same standard. Uploaded resume files are processed in memory and stored as structured data — raw file binaries are not retained after parsing completes.
Access Controls
- Production database access is restricted to authorised engineers via IP-allowlisted connections
- All admin actions within the platform (token allocation, tenant management, subscription provisioning) require authenticated superadmin credentials
- Tenant isolation is enforced at the API layer — organisation members can only access data scoped to their workspace
- Personal workspace data is logically separated from organisation workspace data at the database level
Authentication
CareerOS uses Google OAuth 2.0 exclusively — we never ask for or store passwords. Authentication tokens are signed JWTs with a 7-day expiry, transmitted only over HTTPS, and stored as HTTP-only cookies on the server side. Signing out invalidates your session immediately.
AI Processing & Third-Party Subprocessors
AI features in CareerOS are powered by Anthropic's Claude API. When you use a feature that involves AI (resume parsing, job matching, cover letters, interview prep), relevant content is sent to Anthropic's API servers over an encrypted connection.
Anthropic's data handling: Anthropic does not use API inputs to train its models. Data sent via the API is processed and returned; it is not retained for model improvement. You can review Anthropic's usage policy at anthropic.com/legal/privacy.
No other AI subprocessors receive your personal or resume data. We do not use OpenAI, Google Gemini, or any other third-party LLM API.
Anthropic's data handling: Anthropic does not use API inputs to train its models. Data sent via the API is processed and returned; it is not retained for model improvement. You can review Anthropic's usage policy at anthropic.com/legal/privacy.
No other AI subprocessors receive your personal or resume data. We do not use OpenAI, Google Gemini, or any other third-party LLM API.
What We Never Do
- We never sell your personal data or resume content to any third party
- We never share your data with recruiters, employers, or job boards without your explicit action
- We never use your data to train AI models (ours or anyone else's)
- We never store your Google password — we only receive a read-only OAuth token
- We never embed third-party advertising trackers or analytics pixels
Incident Response
In the event of a security incident affecting personal data, we will notify affected users within 72 hours of becoming aware of the breach, in compliance with applicable data protection laws. Notifications will be sent to the email address associated with your account.
Vulnerability Reporting
If you discover a security vulnerability in CareerOS, please report it responsibly to security@careeros.in. We will acknowledge receipt within 48 hours and keep you updated on our investigation and remediation. We ask that you not publicly disclose the issue until we have had a reasonable opportunity to address it.
Your Rights & Data Deletion
You can request a full export or deletion of your personal data at any time by emailing hello@careeros.in. Deletion requests are processed within 30 days. See our Privacy Policy for full details on your data rights.
Questions about security?
Email us at security@careeros.in for security-related inquiries, or hello@careeros.in for general privacy questions.