Security and your data

Your email address, for signing in. The resume data you enter or upload: work history, education, skills, links. The postings you paste or accept, and the documents, fit checks and check reports written for them. If you subscribe, your billing status from Stripe; the card number never reaches us. Product analytics keyed to your account id, never to the contents of your documents.

Every connection is encrypted in transit. In the database, access is scoped to your account at the row level, so a request from one account cannot read another account’s rows even if the application code had a mistake in it. Resume content is kept out of our logs and error reports. Session replay, which we use to see where people get stuck, masks every word on the screen and hides every field inside the product; it shows clicks, scrolling and layout, not your name or your resume.

Signing in uses an email link or your Google account; there is no password to leak. We hold no security certifications such as SOC 2 today and do not claim to.

Writing and checking your documents sends your profile and the posting to Anthropic’s Claude API. Under the API terms we use, that data is not used to train Anthropic’s models. No other third party receives your resume data, and nothing about you is sent to any model except to do the work you asked for.

Each receives only what its job requires. With your consent on the public pages only, the advertising platforms named in the privacy policy receive measurement events; inside the product they learn that someone signed up or subscribed, never what was written.

• Supabasedatabase, sign-in, file storage
• Vercelhosting the application
• Anthropicwriting and checking documents (Claude API)
• Fly.iorendering PDFs
• Inngestrunning background jobs
• Stripepayments
• Resendsending email such as sign-in links
• Sentryerror reports, with resume content and emails scrubbed first
• PostHogproduct analytics and masked session replay

Delete any application from its page, and it is gone. Delete your account from Settings, and your profile, postings, documents, files and history are removed permanently and immediately; there is no waiting period and no email to send. Your documents can be downloaded as PDFs at any time before that.

If you find a security problem, write to support@airtight.so with what you found and how to reproduce it. A human reads it, usually within one business day, and we will tell you what we did about it. If a breach ever affects your data, we will notify you promptly.