1. Overview
Resumedit is a service of MundusWeb LLC, a Massachusetts limited liability company. We take the security of your data seriously. This Security Policy outlines the measures we implement to protect your personal information, resume data, and account credentials.
2. Data Encryption
2.1 Encryption in Transit
All data transmitted between your browser and our servers is encrypted using industry-standard TLS (Transport Layer Security) 1.2 or higher. This ensures that your information cannot be intercepted or read by unauthorized parties during transmission.
2.2 Encryption at Rest
Your data is stored securely using encryption at rest. Database credentials, API keys, and sensitive configuration data are encrypted and stored securely in our infrastructure.
3. Authentication and Access Control
- Password Security: Passwords are hashed using bcrypt before storage. We never store plain-text passwords.
- Session Management: Secure session tokens are used for authentication, with automatic expiration and invalidation on logout.
- Sign in with Google: You can sign in with your Google account, which means your Resumedit sign-in inherits whatever protections you have on that Google account, including two-step verification if you have it switched on. Resumedit does not yet offer a second factor of its own. If you sign in with an email address and password, that password is the only factor.
- Access Controls: Role-based access control ensures users can only access their own data.
4. Infrastructure Security
4.1 Hosting and Infrastructure
Our application is hosted on Vercel, which provides enterprise-grade security including:
- DDoS protection and mitigation
- Automatic SSL/TLS certificates
- Regular security updates and patches
- Network isolation and firewall protection
4.2 Database Security
We use Supabase for database and storage services, which implements:
- Encrypted database connections
- Row-level security policies
- Regular automated backups
- Database access logging and monitoring
5. Content Security Policy (CSP)
We implement strict Content Security Policy headers to protect against cross-site scripting (XSS) attacks:
- Nonce-based script execution (no unsafe-inline scripts)
- Restricted script sources (only trusted domains)
- Object-src and frame-ancestors restrictions
- Strict connect-src policies for API calls
6. Payment Security
All payment processing is handled securely through Stripe, a PCI DSS Level 1 compliant payment processor. We never store or have access to your full credit card information. All payment data is encrypted and processed according to industry standards.
7. API Security
- API Authentication: All API endpoints require valid authentication tokens
- Rate Limiting: Rate limiting is applied across the endpoints that matter most: resume generation, enhancement, parsing and analysis, cover letter generation, skill extraction, the contact form, registration, sign-in, password reset, and staff authentication
- Input Validation: All user inputs are validated and sanitized
- Error Handling: Error messages do not expose sensitive system information
8. Monitoring and Incident Response
- Continuous monitoring of system logs and security events
- Automated alerts for suspicious activities
- Security review of changes before release, and dependency vulnerability scanning
- Incident response procedures for security breaches
If a breach affects the personal information of a Massachusetts resident, Massachusetts law (M.G.L. c. 93H) requires us to notify the Office of Consumer Affairs and Business Regulation, the Attorney General, and every affected resident, without unreasonable delay. Our incident response procedure is built around those obligations, and we would notify affected users in other states on the timeline their own law requires.
9. Third-Party Security
We carefully vet and monitor third-party services we integrate with:
- OpenAI: Used for AI features with strict data handling policies
- Supabase: Database and storage with enterprise security
- Stripe: PCI DSS compliant payment processing
- Vercel: Secure hosting infrastructure
- Datadog: Application error and performance monitoring
- Resend: Transactional email delivery
- Cloudflare: Turnstile bot protection at registration
- Google: Sign-in with Google, and website measurement on our public pages
Section 8 of our Privacy Policy sets out what each provider receives and why.
10. Data Retention and Deletion
You can delete your account at any time from your account settings. When you do, we immediately cancel any active subscription and delete your account record and everything linked to it, including resumes, cover letters, saved jobs, contacts, and credit history, from our live database.
Three things outlive that deletion, and we want to be straight about them:
- Payment records. Stripe keeps a record of your transactions, and so do we in summary form, because tax and chargeback rules require it.
- Encrypted backups. Our database backups roll on a fixed schedule and expire on their own. Deleted data can persist in a backup until that backup ages out. We do not restore deleted accounts from backups.
- Operational logs. Error and performance logs held by our hosting and monitoring providers expire on their retention schedules.
If you want confirmation that deletion has completed, or you want us to account for what remains, email legal@resumedit.com.
11. Password Requirements
We require strong passwords to protect your account. All passwords must meet the following requirements:
- Minimum 8 characters in length
- At least one uppercase letter (A-Z)
- At least one lowercase letter (a-z)
- At least one number (0-9)
- At least one special character (!@#$%^&*()_+-=[]{}|;:,.<>?)
Additional security recommendations:
- Use a unique password that you don't use elsewhere
- Enable OAuth authentication when available (Google sign-in)
- Log out from shared or public computers
- Keep your browser and operating system updated
- Report any suspicious activity immediately
12. Security Updates
We update our systems and dependencies to address security vulnerabilities. Critical security updates are applied as soon as we are able to, and routine dependency updates are applied as part of ordinary development.
13. Reporting Security Issues
If you discover a security vulnerability, please report it responsibly to security@resumedit.com. We appreciate your help in keeping Resumedit secure. Please do not disclose security issues publicly until we have had a chance to address them.
14. Compliance
Resumedit is operated from the United States by a Massachusetts company, and our privacy practices are built around United States federal and state privacy law. Where a state privacy law applies to us, we comply with it, and we extend its core protections, including the right to opt out of the sale or sharing of personal information and honouring Global Privacy Control signals, to every user regardless of where they live. We do not currently hold ourselves out as operating a GDPR compliance programme.
15. Contact Us
If you have questions about our security practices, please contact us at security@resumedit.com. For privacy questions and rights requests, contact legal@resumedit.com