Security & Privacy at CareerWin
Welcome to the Security and Privacy center for CareerWin. In an era where personal and professional data is frequently monetized, we take a fundamentally different approach. Our platform is engineered from the ground up to protect your most sensitive career assets—your resume, your work history, and your strategic career goals. We believe that security is not just a feature, but a fundamental right. Your career data belongs to you, and our mission is to safeguard it while providing you with the tools you need to succeed. This document outlines our security practices, our engineering philosophy, and our ironclad commitments to your privacy. We are fully transparent about how your data is handled, stored, and protected within the CareerWin ecosystem. We do not rely on commodity embellishment, but rather secure verifiable claims to help you build the strongest possible professional narrative.
1. Your Data Ownership Guarantee
At CareerWin, we operate under a strict principle of user data ownership. When you upload your resume, connect your professional profiles, or generate career narratives, that data remains your exclusive property. We act solely as custodians of your information. You retain the absolute right to export, modify, or permanently delete your data at any time, with zero friction and zero questions asked. Our systems are designed to ensure that if you decide to leave our platform, you can take your entire digital footprint with you.
We do not hold your career history hostage. Your narrative is yours to control, and our architecture strictly enforces your ownership rights across every database table and storage bucket. We are committed to absolute data sovereignty for every single user. This means your Narrative Base Files are accessible to you and you alone. We provide full transparency into what data we hold on your behalf.
2. Encryption Architecture (AES-256 at rest, TLS 1.3 in transit)
To protect your information from unauthorized access, we employ robust encryption protocols across our entire infrastructure. All data stored within our systems is encrypted at rest using AES-256, an industry-standard cryptographic algorithm that ensures your information is fundamentally unreadable without the correct decryption keys. This applies to your profile data, generated documents, and all associated metadata.
Furthermore, we mandate the use of TLS 1.3 for all data in transit. Whether you are accessing our application from a coffee shop or a corporate network, your connection to our servers is secured by the latest transport layer security standards, preventing interception and tampering. Our encryption architecture forms a foundational layer of defense, ensuring that your sensitive career details are shielded at all times from prying eyes.
3. Infrastructure - Vercel Edge Network, Supabase Row-Level Security
The foundation of our platform relies on world-class infrastructure providers. We deploy our application on the Vercel Edge Network, which provides a highly resilient, globally distributed hosting environment that automatically defends against DDoS attacks and ensures high availability. This guarantees that CareerWin remains fast and responsive while providing an inherently secure deployment architecture.
For our database and authentication layers, we utilize Supabase. Crucially, we implement aggressive Supabase Row-Level Security (RLS) policies. RLS acts as a cryptographic bouncer at the database level, ensuring that database queries can only access rows belonging to the authenticated user making the request. Even in the highly unlikely event of an application-level vulnerability, our database strictly enforces these isolation guarantees, mathematically preventing unauthorized cross-tenant data access. Your data is isolated and protected by the most advanced database security features available.
4. What We Never Do (no data selling, no third-party sharing, no training on your data)
Trust is built on clear boundaries, and we want to be absolutely explicit about what we will never do with your information. CareerWin is a subscription-based product; you are our customer, not our product. We will never sell your personal information, resume data, or career history to data brokers, advertisers, or any third party. We do not engage in unauthorized third-party sharing under any circumstances.
Furthermore, we explicitly guarantee that we do not use your private career data to train generalized AI models. The narratives and documents you generate are for your use alone. We rely on verifiable claims and strict isolation, ensuring your competitive advantage remains entirely confidential. Your professional secrets, target companies, and personalized strategic insights are safe with us. We exist solely to accelerate your career, not to monetize your private ambitions.
5. Our Privacy-First Engineering Philosophy
Our commitment to security extends beyond technical implementations; it is deeply ingrained in our engineering culture. We operate under a privacy-first engineering philosophy, which means that security considerations are integrated into the earliest stages of our product development lifecycle. We practice the principle of least privilege, ensuring that our internal systems and personnel only have access to the absolute minimum information required to operate the service.
We continuously audit our codebase, run automated vulnerability scans, and adhere to secure coding practices to mitigate risks before they ever reach production. We believe in transparency and honest communication regarding our capabilities. We continuously refine our defenses and prioritize the integrity of your professional Narrative Base Files above all else. Your trust is our most critical asset, and we engineer every feature to honor it.