HireRoom
Security

How your data is actually protected.

This page describes controls that exist in the codebase today, in plain language. Where we do not hold a certification, we say so.

  • Encryption in transit and at rest

    All traffic is served over TLS. OAuth access and refresh tokens for connected inboxes are stored encrypted with AES-GCM (per-record nonce, authentication tag), never in plaintext. Card numbers never touch our servers; payments run through Clerk, Razorpay, PayPal, or Stripe directly.

  • PII stays out of telemetry

    Error and performance events are scrubbed before they leave the process: emails, names, tokens, and profile-shaped fields are redacted by key pattern and by value pattern. The scrubber is unit-tested so a regression fails the build, not your privacy.

  • Tenant isolation, enforced by tests

    Every query that touches member data is scoped to the signed-in user, and ownership checks run server-side on each mutation. A dedicated tenant-isolation test suite attempts cross-user reads and writes and expects them to fail.

  • Signed webhooks only

    Inbound webhooks (Clerk, Resend) are verified against their signing secrets before a single byte of the payload is processed. Unsigned or mis-signed deliveries are rejected.

  • Secrets stay server-side

    API keys and tokens live in server environment variables. Responses that serialize your profile pass through a strip-list that removes secret-shaped fields before anything reaches the browser.

  • Extension with a narrow blast radius

    The Chrome extension declares host permissions for the three supported ATS domains and this site only. Its token authorizes profile reads and autofill logging; it cannot delete or modify your data.

Sub-processors

The services below can touch member data. This is the same list the privacy policy publishes, read from one shared source so the two cannot drift. Active means wired into a live product flow today; dormant means the code exists behind an unreleased feature and no member data flows to that provider.

  • ClerkactiveAuthentication + current billing wrapperEmail, name, plan tier, sign-in events
  • RazorpayactivePayment processing (India / INR)Name, email, plan, transaction + subscription IDs
  • PayPalactivePayment processing (international / USD)Name, email, plan, transaction + subscription IDs
  • Stripe (via Clerk)activeCard processing for the current Clerk-managed billingName, billing address, card token, transaction IDs
  • VercelactiveApplication hosting + Analytics + Speed InsightsRequest logs, performance metrics (no profile PII by default)
  • Turso (libSQL)activePrimary database hostingApplication data: profile, resumes, applications, synced inbox metadata
  • SentryactiveError + performance monitoringDiagnostic events, stack traces, request context (PII scrubbed)
  • AnthropicactiveLLM inference (default)Relevant profile slice + job posting text at request time
  • OpenAIactiveLLM fallback + Realtime voice for mock interviewsProfile slice, job text, and voice audio only when voice mock is used
  • DeepSeekdormantLLM inference for the Astra discovery agentsProfile slice + job posting text at request time
  • SerpApidormantProgrammatic job-listing search for Astra discoverySearch terms derived from role + location preferences (no resume content)
  • ResendactiveTransactional email (welcome, alerts, digests, OPT countdown)Email address + transactional content

Dormant rows are Astra-only providers (DeepSeek, SerpApi). Astra is unreleased, so they receive no end-user data today; they are listed because the wiring exists and this page must describe the code, not the roadmap.

What we do not claim

  • · We do not hold SOC 2 or ISO 27001 certification today. When that changes, this page changes.
  • · No system is unbreachable. We will not use grade-inflation adjectives here; the controls above are the honest description.
  • · We do not sell your personal information. The full posture lives in the privacy policy.

Report a vulnerability

If you believe you have found a security issue, open a ticket at /supportwith “security” in the subject. We investigate every report and respond as quickly as we can. Please do not test against other members’ data.

Your own controls: export or delete your data from /help/data-export, and manage consent choices at /consent.