Security practices
Updated: July 2026
We take practical security seriously for a personal CV tool. This page describes what we actually do in V1 — not marketing badges we have not earned.
Transport and sessions
Public traffic is expected over HTTPS/TLS. Signed-in sessions use secure cookie practices (HttpOnly session cookies where the auth stack applies). Sensitive server routes such as print/export accept only internal authorization (for example secret headers) so arbitrary clients cannot render other users’ print URLs.
Access control
Cloud resumes and workspace sessions are scoped to the signed-in user. Admin and API surfaces are separated from the public marketing site. Rate limits and LLM budget circuit breakers reduce abuse even when billing mode is free or shadow. Export uses a pooled Chromium worker with concurrency caps so one job cannot freely exhaust the host.
Human-in-the-loop writes
Security is also product design: the AI copilot proposes diffs; the CV “source of truth” updates only after you Accept (or you edit manually). That reduces silent corruption of your career facts by a model error. Local drafts stay on your device until you sign in and sync.
What V1 is not
V1 does not claim SOC 2, ISO 27001, HIPAA, or similar third-party certifications. We do not promise military-grade isolation or zero-knowledge encryption of every field. We are a focused consumer tool: sensible defaults, least privilege in code paths we control, and continuous hardening as the product matures. If you need enterprise compliance paperwork, that is outside V1 scope (no B2B org product in this release).
Incidents and vulnerability reports
If you believe you found a security issue, send reproducible steps via Contact. Please do not exploit production beyond responsible disclosure, do not access other users’ data, and give us a reasonable window to fix before public detail. For account compromise or suspected data incidents affecting you, contact us promptly so we can reset sessions and investigate. Report via Contact