All traffic to and from the platform is served over HTTPS/TLS.
Your dashboard and resume data are protected by Postgres row-level security — only your authenticated account can read or edit your draft data. Published pages are readable publicly by design (that’s the point of publishing), but only once you’ve explicitly made a resume live.
If you use your own AI provider key (bring-your-own-key mode), it is sent directly with your request and is never written to a database or log. Cognifix-managed AI keys, used in managed mode, are never exposed to the browser.
Passwords are hashed and managed by Supabase Auth — we never see or store your password in plain text.
If you believe you’ve found a security vulnerability, please report it to Cognifix Technologies rather than disclosing it publicly, so it can be fixed first.