Security at BioCareerAI

Encryption

Connections to the BioCareerAI website and API are encrypted with TLS, with HTTP Strict Transport Security enabled.

The production database and uploaded CV files are encrypted at rest.

Infrastructure

BioCareerAI is hosted on Amazon Web Services in the United States; the web application is served by Vercel. The production database is not reachable from the public internet.

A web application firewall protects the API, and AWS account activity is recorded in audit logs.

Automated database backups are enabled, with point-in-time recovery over a 14-day window.

Access control

Employer workspaces are isolated by tenant, and requests to workspace data are authorised against the caller's organisation. Roles within a workspace (recruiter, hiring manager, HR, admin) limit what each user can see and change.

Two-factor authentication is available for candidate and employer accounts. Sessions expire after a period of inactivity.

Security practices

Code and dependencies are automatically scanned for leaked credentials and known vulnerabilities on every code push, and the repository history is re-scanned weekly.

We carry out internal security reviews of authentication, authorisation and tenant isolation, with automated regression checks, and we maintain an incident response process. We have not yet commissioned an independent third-party assessment.

Threat detection (Amazon GuardDuty) is enabled on our AWS environment.

Data handling

Candidates can delete their account at any time. Personal data is removed from our live systems on deletion; automated database backups expire within 14 days, and a minimal security log is retained for 12 months.

AI processing uses the API services of Microsoft Azure OpenAI, OpenAI and Anthropic under terms that do not permit our data to be used for model training.

Subprocessors: Amazon Web Services (hosting, US), Vercel (web application), Microsoft Azure OpenAI, OpenAI and Anthropic (AI processing), Resend (transactional email), Stripe (payments), Google (sign-in).

Reporting a vulnerability

If you believe you have found a security issue, email hello@biocareerai.com. We aim to acknowledge reports within five business days. Please test only with accounts you own, and do not access other users' data, degrade the service, or send unsolicited messages to our users.

Machine-readable contact details are published at /.well-known/security.txt. This page does not constitute authorisation to test beyond these guidelines.