Security

Career conversations are personal. Salary numbers, performance worries, and rehearsal mistakes shouldn't leak. This page describes how we protect them — at the network, application, and operational layers — and how to report a problem if you find one.

1. Account security

• Password hashing. Passwords are hashed with a modern, memory-hard algorithm (bcrypt / Argon2-class) with a per-user salt. We never store or log plaintext passwords.
• Session tokens. Sessions use signed, short-lived tokens. Tokens are invalidated on logout and rotated on password change.
• Email-link sign-in. Magic links are single-use, expire quickly, and are bound to the requesting browser.
• Rate limiting. Authentication and password-reset endpoints are rate-limited to slow brute force.
• Security alerts. We email you when a new device signs in or sensitive account changes occur.

2. Data protection

• Encryption in transit. All traffic uses TLS 1.2+ with HSTS. HTTP requests are redirected to HTTPS.
• Encryption at rest. Databases, backups, and object storage are encrypted with provider- managed keys (AES-256 or equivalent).
• Backups. Production databases are backed up daily; backups are encrypted and age out on a rolling 30-day window.
• Data minimization. We collect only what we need to run sessions and generate feedback, and we drop unnecessary identifiers from analytics events.

3. Infrastructure

• Managed hosting. The app runs on reputable cloud providers with SOC 2 / ISO 27001 attestations.
• Network isolation. Application servers and databases run in private networks. Only the public web tier is internet-exposed.
• Secrets management. API keys and credentials are stored in a secrets manager, not in source code, and are rotated on incident.
• Least privilege. Production access is restricted to a small operations group with auditable SSO logins and MFA enforced.

4. Application security

• Authentication & authorization. Every API call is authenticated and authorized server- side. Object-level checks ensure you can only access your own sessions.
• Input handling. Inputs are validated and parameterized; we use ORM/query builders to mitigate injection. Outputs are escaped to prevent XSS.
• Dependency hygiene. We track upstream advisories and apply security patches promptly. CI runs vulnerability scans on every pull request.
• Code review. Changes to security-sensitive paths require review before they reach production.
• Open source. Significant portions of our stack are public on GitHub, making review easier for the community.

5. AI and third-party processors

• Persona replies and scoring run through model providers under data-processing agreements. We disable training-on-your-data settings where the provider exposes them.
• Only the messages needed to produce the next response are sent — we don't push your whole history with every call.
• We log enough request metadata to debug failures, but redact obvious sensitive fields.

6. Monitoring and incident response

• Production services emit metrics, structured logs, and error traces to a centralized observability stack.
• Alerts page the on-call when error rates, latency, or auth-failure rates breach thresholds.
• Confirmed security incidents follow a documented response process: contain, eradicate, recover, and a post-incident review.
• If a confirmed incident affects your data, we'll notify you without undue delay — and in any case within the timelines required by applicable law.

7. Account hygiene tips for you

• Use a unique, strong password — ideally generated by a password manager.
• Sign in only on devices you trust. Sign out from shared machines.
• Keep your email account itself secure (it's the root of your careersim.ai access).
• Watch for emails from us — we'll never ask you to share your password.

8. Responsible disclosure

If you believe you've found a vulnerability, please report it privately before disclosing it publicly. We welcome research that follows these guidelines:

• Test only against your own account or accounts you have explicit permission to test.
• Don't access, modify, or delete other users' data. Don't run denial-of-service tests against production.
• Give us a reasonable window — typically 90 days — to investigate and remediate before public disclosure.

Send reports to security@careersim.ai with reproduction steps and impact. We'll acknowledge within 2 business days, keep you informed of progress, and credit you on request after the issue is resolved.

9. Limits

No system is perfectly secure. We invest continuously in detection, remediation, and engineering practice, but we can't guarantee absolute security. We commit to being honest with you when something goes wrong.

Questions about this page? Email hello@careersim.ai.