Security

1. Core protections

• Enterprise-grade storage — All data is stored in enterprise-grade, security-hardened infrastructure with encryption at rest, isolated environments and continuous monitoring. We do not run the service on consumer-grade storage.
• Encryption everywhere — All traffic is served over HTTPS/TLS, so data is encrypted in transit between your browser, our API and our providers. Stored data and backups are encrypted at rest.
• Social-only, token-based sign-in — We never handle passwords. Sign-in happens through Google or LinkedIn OAuth; we store nothing more than a basic profile. Sessions use short-lived JWT access tokens with refresh-token rotation and server-side revocation.
• Ownership checks on every resource — Authentication alone is not enough. Every read and write path verifies that the resource belongs to the requesting user, so one account can never access another account’s data — not even by guessing an identifier.

2. How we operate securely

• Least-privilege access — Internal access to production data is restricted to a small set of authorised personnel, is role-based and is reviewed. Administrative actions require stronger authentication.
• Two-factor authentication — Administrator accounts are protected with TOTP two-factor authentication before they can reach privileged tooling, and the dashboard session is scoped and short-lived.
• Audit logging — Sensitive operations — account changes, deletions, administrative actions and AI usage — are recorded in audit logs so activity can be traced and investigated.
• Minimal data by design — We do not request sensitive or special-category data, and we do not collect what we do not need. Less data collected means less data to protect.
• Uploads are not retained — CVs uploaded to the standalone ATS checker are parsed in memory and never written to storage or the database; only a one-way hash is kept so an identical check can be reused.
• Secure payments, no card data — Payments are processed by Stripe, a PCI-DSS compliant provider. Card details are entered on Stripe’s infrastructure — ResmiAI never sees or stores full card numbers.
• Hardened infrastructure — Dependency updates, bounded retries, rate limiting and quota enforcement protect the service against abuse, runaway automation and denial-of-service attempts.
• Incident response — We maintain an incident-response process. If a personal-data breach ever occurs that is likely to affect your rights, we will notify you and the relevant authority without undue delay and within the GDPR timelines.

3. Strongest protection for every user, including free

Security is a baseline, not a premium feature. The protections below are identical on the free plan and on every paid plan.

• Free, Pro and Business accounts receive identical security controls.
• Security is never gated behind an upgrade or used as an upsell.
• Data deletion works the same way on every plan: one action, permanent erasure.
• Encryption, ownership checks and audit logging apply to every account, unconditionally.

4. Your part

• Keep the Google or LinkedIn account you sign in with secure, and use multi-factor authentication on that account.
• Treat generated documents as confidential until you choose to send them.
• Sign out of shared devices, and use the Settings page to revoke access if you suspect misuse.
• Report anything suspicious to [email protected].

5. Responsible disclosure

If you believe you have found a security vulnerability, please contact [email protected] before disclosing it publicly. We investigate every credible report, will not pursue users who act in good faith, and will keep you updated on the outcome.