Encrypted in transit
All traffic runs over HTTPS/TLS, and database connections are encrypted. Your resumes are not sent in plaintext over the network.
Legal
Security
Last updated: September 16, 2026
How we protect your account, your resumes, and your job applications — and what you can do to help.
Modern authentication
Email verification, secure password hashing, Google OAuth, and expiring sessions. Service credentials live server-side only — never in browser code.
Scoped data access
Every request is authorized against your session. Users can only ever read and write their own resumes, profiles, and applications.
Managed infrastructure
We run on managed hosting and managed Postgres instead of hand-rolled servers, so platform updates and patches are handled for us.
Rate limiting & logging
Rate limiting on auth and sensitive endpoints, with logs on key actions to help spot misuse.
Database backups
Managed database backups depend on your hosting plan — we rely on our provider's backup and recovery tooling.
What you can do
- Use a strong, unique password — a password manager makes this painless.
- Don't share your login, and sign out on shared devices.
- Keep the email on your account current so password resets reach you.
- Treat unexpected emails asking for credentials as phishing and report them to us.
Incident response
If we ever discover unauthorized access affecting user data, we will investigate immediately, contain it, notify affected users with what happened and what we're doing, and review our controls so it doesn't recur.
Report a vulnerability
Found a security issue? Email hello@careercopilot.com with details and steps to reproduce. Please give us reasonable time to fix it before any public disclosure — we'll keep you posted throughout.