Security Overview
Last Updated: June 9, 2026
Secure Cognito
Session controls, token issuance, and password policies are handled strictly by secure Amazon Cognito services.
AES-256 Storage
Candidate data, resume configurations, and uploaded resources are encrypted at rest with AES-256 standards.
Private AI Calls
AWS Bedrock endpoints do not retain prompts, log candidate details, or train base algorithms with your resume texts.
1. Authentication & Account Safeguards
We safeguard access points using industry-recognized protocols. User authentication, password rules, token validations, and Multi-Factor Authentication (MFA) parameters are processed directly through Amazon Cognito. Passwords are never stored in raw text, and access tokens are managed using cryptographically signed JSON Web Tokens (JWTs) with secure expiry headers to prevent session hijacking.
2. Encryption Standards
Your data is guarded against unauthorized access whether it is crossing the web or resting in our databases:
- In Transit: All data transmitted between user web interfaces, client applications, and our backend service endpoints is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
- At Rest: User database entries, profile values, resume assets, and storage buckets are encrypted using Advanced Encryption Standard (AES-256) keys managed securely via AWS Key Management Service (KMS).
3. AWS Bedrock AI Privacy Boundaries
EliteResume AI utilizes AWS Bedrock API layers to run high-performance LLM optimizations. We configure our AI pipelines to enforce maximum data boundary protections:
- Zero Retention: AWS Bedrock is configured with zero-retention policies. Prompts and resume bullets sent to the API are parsed in volatile memory and immediately discarded once suggestions are compiled.
- No Model Training: None of your resume text, accomplishments, templates, or candidate logs are ever stored or used by AWS or third parties to train underlying AI models.
4. Payment Processing (PCI-DSS Compliance)
EliteResume AI does not collect, store, or process credit card numbers or raw billing details. All financial transactions are delegated directly to Stripe, which is certified as a PCI-DSS Level 1 Service Provider. Stripe processes payments securely using tokenized systems, ensuring your payment methods remain completely isolated from our platform databases.
5. System Audits & Infrastructure
Our core hosting infrastructure is deployed in secure Amazon Web Services (AWS) regions matching SOC 2, ISO 27001, and ISO 20071 information security frameworks. Furthermore, our platform is fronted by the Cloudflare CDN, which provides rapid, global edge delivery and enterprise-grade Web Application Firewall (WAF) protections to mitigate threats. All design methodologies and security management guidelines align with the National Institute of Standards and Technology (NIST) cybersecurity standards.
Found a security issue?
We value responsible disclosures. Report any vulnerabilities directly to our security response desk.