How your data is protected
Career Best handles sensitive personal information — your resume, your answers to screening questions, and a record of every job you apply to. This page describes what is actually built today, not a roadmap. Where something isn’t built yet, it says so instead of promising it. More detail is in our design docs.
Your data belongs to you
Export everything as JSON or permanently delete your account and everything in it, any time, from Settings — no email, no waiting, no support ticket. We don't sell data, and don't use it for advertising.
Encrypted in transit; standard managed-database encryption at rest
Every connection to the site uses HTTPS with HSTS enforced. Your profile, resumes, and answer bank are stored in a managed Postgres database, which encrypts its storage at rest by default. We don't currently apply additional column-level encryption on top of that.
Your account can't see another's data
Every record is tied to your account ID and every query the app makes is filtered to the signed-in user — verified directly against the database: a second account gets a plain 404, not someone else's row, for every agent, match, and application endpoint. The database also has row-level security policies defined as a second layer, though the app's own scoping is the enforced boundary today.
What the AI actually sees
The ATS “tailor with AI” feature sends your résumé text and the job description to Google's Gemini API to generate the rewrite — not a redacted subset. We don't have a data-processing agreement or a confirmed zero-retention tier with Google for this yet, so treat that feature like any other cloud AI tool: don't paste anything in a résumé you wouldn't want a model provider to process. Résumés aren't sent to any AI unless you use that feature.
The AI never invents facts, and never guesses protected-class answers
The rewrite tool is instructed to keep every employer, title, date, and skill exactly as you wrote them, and we run an automated check afterward for things like new dates or changed contact details, flagged for you to review before you use the result. EEO / voluntary-disclosure questions are never asked of or answered by any AI in this product — you set those yourself in your answer bank, verbatim, including “prefer not to answer.”
Every account action is logged
Creating, editing, pausing, or deleting an agent; queuing an application; account and security events — all are written to an audit log tied to your account. A 'pause all agents' switch on every page sets every active agent to paused in one click; a paused agent refuses to run a scan until you resume it.
Password sign-in, with a real reset flow
Accounts use a password (bcrypt-hashed, never stored in plain text). Forgot it? The reset link is a one-time, sha256-hashed token that expires in an hour and is only ever emailed to the address already on the account — the response is identical whether or not that email has an account, so the flow can't be used to find out who has signed up.
Rate limits on every public endpoint
Sign-in, sign-up, password reset, the live scan, résumé upload/parsing, AI tailoring, and the contact and source-suggestion forms are all rate-limited per IP. Admins can disable a job source manually if it starts misbehaving; there isn't yet an automatic anomaly-triggered shutoff.
The tenant-isolation model, secrets handling, and audit design are specified in docs/DESIGN_REVIEW.md §D1 and §B3, and the data model enforcing them is in prisma/schema.prisma. Known gaps (RLS not yet the enforced backstop, no third-party credential vault because no feature needs one yet, no automated anomaly circuit breaker) are tracked there rather than glossed over here.
Found a vulnerability? Tell us.