Trust & Safety
Your resume and account may contain personal information such as your name, contact details, employment history, education, and uploaded documents. This page explains how ResuPulse helps protect that information through secure authentication, session management, request validation, access controls, rate limiting, and carefully managed cloud infrastructure. It also outlines the responsibilities that remain with users, such as protecting account credentials and keeping private report links confidential.
We describe our security practices as accurately and transparently as possible. Where a protection depends on trusted cloud providers or third-party services, we explain that distinction so you can better understand how your information is processed, stored, and protected while using ResuPulse.
Security Practices
Security relies on multiple layers working together rather than a single feature. The practices below describe the safeguards currently used to help protect user accounts, uploaded resumes, application data, and platform services.
Passwords are protected using the bcrypt password hashing algorithm with a work factor of 12. ResuPulse stores only the resulting password hash rather than the original password. Password resets and password changes always replace existing credentials instead of revealing previously stored passwords.
Authentication uses HTTP-only cookies to reduce exposure to client-side scripts. Cookies use SameSite=Lax, while production deployments additionally apply the Secure attribute and the __Host- cookie prefix where supported. Short-lived access tokens and independently managed refresh sessions help reduce the impact of compromised sessions.
Protected API requests pass through a shared request validation layer that performs CSRF protection where required, validates request data, applies file-type and file-size restrictions, verifies uploaded PDF signatures when applicable, and returns standardized error responses.
Account-owned data is validated against the authenticated user before it can be viewed, updated, or deleted. Guest-generated AI reports are intentionally different because they are designed to be accessible through their unique report link or identifier. Anyone with that link should be considered an authorized viewer, so those links should be kept private.
Authentication, AI tools, Careers services, assessments, and support endpoints use purpose-specific rate limits to reduce abuse and protect service availability. Authentication-related limits fail closed when protection services are unavailable, while most product endpoints fail open to minimize disruption during infrastructure incidents.
Resume files uploaded through the Careers platform are validated before being stored as private Cloudflare R2 objects. Access is provided only through authenticated application routes. PDF files uploaded to public AI tools are processed for text extraction but are not intentionally stored in the Careers document storage system.
Data Handling
Protecting information also depends on how data moves through the platform, where it is stored, how long it is retained, and which safeguards are provided by trusted infrastructure providers. The following sections explain these boundaries in greater detail.
Communication between your browser and ResuPulse is protected using HTTPS. When AI-powered features are used, resume text and tool-specific inputs are securely transmitted to trusted third-party AI providers for processing as part of the requested service.
Product data is stored in MongoDB Atlas, while Careers resume files are stored as private Cloudflare R2 objects. Access permissions are enforced through the application, while infrastructure-level storage protections are managed by the underlying cloud providers.
Resume files uploaded to AI tools are processed to generate analysis and results. Processing metadata and generated reports may be stored according to product requirements, while guest reports remain accessible to anyone with the associated report link or identifier.
Sensitive service credentials are managed through secure server-side environment configuration rather than being exposed to browsers. Account management features, including export and deletion controls, are documented in the Privacy Policy together with applicable data-retention information.
If you believe you have discovered a security vulnerability, please send a clear description, the affected page or feature, steps to reproduce the issue, and the potential impact. Please avoid accessing other users' information, disrupting the service, or publicly disclosing sensitive details while the issue is under review.
[email protected]For detailed information about data collection, AI processing, storage, retention, third-party processors, account controls, and deletion requests, please review the complete Privacy Policy.
View the Privacy Policy