Effective July 28, 2026 · Cognifix Technologies Private Limited
All traffic to and from the platform — the app, the API, and every published resume page — is served over HTTPS/TLS. Plain-HTTP requests are redirected.
Your dashboard and resume data are protected by Postgres row-level security — only your authenticated account can read or edit your draft data. Published pages are readable publicly by design (that's the point of publishing), but only once you've explicitly marked a resume as live.
Data in transit is encrypted via TLS. Data at rest (your account, resume data, and uploaded photos) is stored on managed infrastructure — Supabase Postgres and Cloudflare R2 — that encrypts data at rest by default.
If you use your own AI provider key (bring-your-own-key mode), it's sent directly with your request and is never written to a database or log. Cognifix-managed AI keys, used in managed mode, live only in server-side environment configuration and are never exposed to the browser.
Passwords are hashed and managed by Supabase Auth — we never see or store your password in plain text. Sessions are managed via secure, signed cookies scoped to the app.
We run on a small set of established infrastructure providers: Supabase (database, authentication), Cloudflare (hosting, CDN, DDoS protection, and file storage), and Razorpay (payment processing). Each is a widely-used, independently-secured provider — we don't run our own database or mail servers.
We monitor the platform for errors and abnormal activity and investigate reports promptly. If we discover a security incident that affects your data, we'll notify affected users and, where required by law, the relevant authorities, without undue delay.
Account and resume data is stored in managed Postgres with provider-level automated backups. Uploaded photos are stored redundantly on Cloudflare R2.
If you believe you've found a security vulnerability, please report it privately to security@airesumebuilder.app rather than disclosing it publicly, and give us a reasonable amount of time to investigate and fix it before sharing details elsewhere. Include enough detail (steps to reproduce, affected URL) for us to act on it quickly. We won't pursue legal action against good-faith, non-destructive security research reported this way.
Security questions or reports: security@airesumebuilder.app.