Security Overview

1. Authentication & Account Safeguards

We protect access using industry-recognized protocols. User authentication, password rules, and token validation are handled through a secure, self-hosted identity provider; passwords are never stored in raw text. Sessions use cryptographically signed JSON Web Tokens (JWTs) with short-lived access tokens, and refresh tokens are delivered in hardened, HTTP-only (__Host-) cookies that are inaccessible to client-side scripts. Tokens can be revoked server-side (for example, on logout) to prevent session reuse.

2. Encryption Standards

Your data is protected both in transit and at rest:

• In Transit: All traffic between user interfaces, client applications, and our backend endpoints is encrypted over HTTPS using modern TLS (up to TLS 1.3).
• At Rest: Database entries, profile values, resume assets, and storage buckets are encrypted at rest using AES-256, managed through our cloud provider's encryption services (AWS S3 and RDS).

3. AI Processing Boundaries (AWS Bedrock)

EliteResume AI uses AWS Bedrock to run large-language-model features such as bullet rewriting, summaries, cover letters, and ATS analysis. EliteMatch AI™, the fine-tuned model behind resume-to-job matching, is hosted on the same infrastructure and under the same boundaries. To deliver these features, the relevant resume or job-description text is sent to Bedrock for processing. We enforce the following boundaries:

• No Model Training: Per AWS Bedrock's service terms, your inputs and outputs are not stored by AWS to train its foundation models, and are not shared with model providers for that purpose.
• No Content Logging on Our Side: Our application records only metadata about each AI request — model used and token counts — and never logs the text of your prompts or the generated output.

4. Payment Processing (PCI-DSS)

EliteResume AI does not collect, store, or process card numbers or raw billing details. All transactions are delegated to Stripe, a certified PCI-DSS Level 1 Service Provider. Stripe handles payments using tokenized methods, keeping your payment details isolated from our platform databases. We retain only non-sensitive references (e.g., Stripe customer and invoice identifiers).

5. System & Infrastructure Security

Our infrastructure is hosted on Amazon Web Services, whose data centers are independently certified to leading information-security standards including SOC 2 and ISO/IEC 27001. Our platform is fronted by the Cloudflare CDN, providing global edge delivery and a Web Application Firewall (WAF) to mitigate common threats. Uploaded files are validated (type, size, and content checks), and access to stored documents is granted only through authenticated, time-limited links. Our security practices are informed by recognized industry guidance, including the NIST Cybersecurity Framework.