Security Policy

🔒 Data Encryption

• Encryption in transit: All communications between your browser and our servers are encrypted using TLS 1.3 with modern cipher suites. We enforce HTTPS across all domains (hiremeup.us, admin.hiremeup.us, api.hiremeup.us).
• Encryption at rest: User data stored in PostgreSQL is encrypted at the storage layer. Passwords are hashed using bcrypt with a cost factor of 12, never stored in plain text.
• API keys: API keys are stored using one-way hashing. Once generated, the full key is only shown once. We cannot recover lost API keys.

🛡 Infrastructure Security

• Security headers: All responses include Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and Referrer-Policy headers.
• Rate limiting: API endpoints are rate-limited to 100 requests per minute per IP address to prevent abuse and brute-force attacks.
• Input validation: All API inputs are validated against strict schemas. Unknown or unexpected fields are rejected with a 400 error.
• CORS: API access is restricted to authorized origins (hiremeup.us, admin.hiremeup.us, and localhost for development).
• Authentication: We use JWT (JSON Web Tokens) with short expiration periods. Refresh tokens are stored securely in HTTP-only cookies.

🤖 AI Data Protection

• AI service providers (DeepSeek) receive only the specific content needed for processing (e.g., your resume text for analysis, not your entire account data).
• AI providers do not train on user data.
• AI requests are transmitted over encrypted connections and are not logged beyond standard service monitoring.

🧩 Chrome Extension Security

• The extension only has the minimum required permissions (activeTab, storage, scripting, notifications).
• Job scraping only activates when you explicitly click the extension icon on supported job listing pages.
• Auto-apply credentials are never stored in the extension — authentication tokens are kept in secure storage and expire after 7 days.
• The extension does not track browsing history or monitor non-job pages.

📋 Compliance & Auditing

• System logs track authentication events, API usage, and admin actions for security auditing.
• Logs are retained for 90 days and are accessible only to authorized administrators.
• We regularly update dependencies and monitor for known vulnerabilities (CVEs).

📧 Report a Security Issue

If you discover a security vulnerability, please email us at security@hiremeup.us. We take all reports seriously and will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have addressed them.