HireRoom
Security

How your data is actually protected.

This page describes controls that exist in the codebase today, in plain language. Where we do not hold a certification, we say so.

  • Encryption in transit and at rest

    All traffic is served over TLS. OAuth access and refresh tokens for connected inboxes are stored encrypted with AES-GCM (per-record nonce, authentication tag), never in plaintext. Card numbers never touch our servers; checkout runs on our billing provider's hosted pages (Clerk, with card processing by Stripe).

  • PII stays out of telemetry

    Error and performance events are scrubbed before they leave the process: emails, names, tokens, and profile-shaped fields are redacted by key pattern and by value pattern. The scrubber is unit-tested so a regression fails the build, not your privacy.

  • Tenant isolation, enforced by tests

    Every query that touches member data is scoped to the signed-in user, and ownership checks run server-side on each mutation. A dedicated tenant-isolation test suite attempts cross-user reads and writes and expects them to fail.

  • Signed webhooks only

    Inbound webhooks (Clerk, Resend) are verified against their signing secrets before a single byte of the payload is processed. Unsigned or mis-signed deliveries are rejected.

  • Secrets stay server-side

    API keys and tokens live in server environment variables. Responses that serialize your profile pass through a strip-list that removes secret-shaped fields before anything reaches the browser.

  • Extension with a narrow blast radius

    The Chrome extension declares host permissions for the three supported ATS domains and this site only. Its token authorizes profile reads and autofill logging; it cannot delete or modify your data.

Sub-processors

The services below can touch member data. This is the same list the privacy policy publishes, read from one shared source so the two cannot drift. Statuses are verified against production usage (2026-08-01): active, wired-but-unused, or dormant.

  • ClerkactiveAuthentication + current billing wrapperEmail, name, plan tier, sign-in events
  • Stripe (via Clerk)activeCard processing for the current Clerk-managed billingName, billing address, card token, transaction IDs
  • VercelactiveApplication hosting + Analytics + Speed InsightsRequest logs, performance metrics (no profile PII by default)
  • Turso (libSQL)activePrimary database hostingApplication data: profile, resumes, applications, synced inbox metadata
  • SentryactiveError + performance monitoringDiagnostic events, stack traces, request context (PII scrubbed)
  • AnthropicactiveLLM inference (default)Relevant profile slice + job posting text at request time
  • OpenAIactiveLLM fallback + Realtime voice for mock interviewsProfile slice, job text, and voice audio only when voice mock is used
  • ResendactiveTransactional email (welcome, alerts, digests, OPT countdown)Email address + transactional content
  • SerpApiactiveProgrammatic job-listing search (Google Jobs) for Discovery top-upSearch terms derived from role + location preferences (no resume content)
  • AdzunaactiveJob-listing search for Discovery top-upSearch terms derived from role + location preferences (no resume content)
  • Google (Gmail API)activeOptional inbox sync for application-tracking emailsMessage metadata + application-related content, only for accounts the member connects
  • Microsoft (Microsoft Graph)activeOptional inbox sync for application-tracking emailsMessage metadata + application-related content, only for accounts the member connects
  • RazorpaywiredPayment processing (India / INR)Name, email, plan, transaction + subscription IDs
  • PayPalwiredPayment processing (international / USD)Name, email, plan, transaction + subscription IDs
  • BrowserbasewiredHosted browser sessions for pre-brief page fetches and the flagged-off scrape tierPublic job-posting pages only
  • AnchorwiredFallback hosted-browser runtime for the same flagged-off fetch pathsPublic job-posting pages only
  • ApollowiredInsider contact lookup (email reveal) for the Network featureEmployer + role query terms; returned business contact data
  • HunterwiredInsider contact lookup (email finder/verifier) for the Network featureEmployer domain queries; returned business contact data
  • People Data LabswiredInsider contact lookup (person enrichment) for the Network featureEmployer + role query terms; returned business contact data
  • DeepSeekdormantLLM inference for the Astra discovery agentsProfile slice + job posting text at request time

Active means a live product flow sends member-derived data today. Wired means code and production configuration exist behind a flag or an unoffered checkout path, with no production usage verified. Dormant means the provider belongs to an unreleased feature (Astra) and receives no member data. The list is one shared source read by this page and the privacy policy, so the two cannot drift.

What we do not claim

  • · We do not hold SOC 2 or ISO 27001 certification today. When that changes, this page changes.
  • · No system is unbreachable. We will not use grade-inflation adjectives here; the controls above are the honest description.
  • · We do not sell your personal information. The full posture lives in the privacy policy.

Report a vulnerability

If you believe you have found a security issue, open a ticket at /supportwith “security” in the subject. We investigate every report and respond as quickly as we can. Please do not test against other members’ data.

Your own controls: export or delete your data from /help/data-export, and manage consent choices at /consent.