Security

1. Security Principles

Security at JobBox is designed around practical risk reduction. We focus on protecting the data users provide to build their career profiles, preventing unauthorized access to administrative tools, keeping AI workflows reliable, and limiting the amount of data exposed to any person, service, or system.

We treat security as an ongoing process rather than a one-time checklist. Product changes, new integrations, infrastructure updates, and operational workflows are reviewed with security impact in mind.

• Defense in Depth: We use multiple layers of protection across authentication, application logic, infrastructure, data storage, logging, and vendor access instead of relying on a single safeguard.
• Least Privilege: Access to user data and internal systems is limited to the people and services that need it for a legitimate operational purpose.
• Data Minimization: We aim to collect and process the information needed to provide the product experience, improve reliability, meet legal obligations, and support users.
• Operational Accountability: Administrative activity is logged where appropriate so unusual access patterns, support actions, and configuration changes can be reviewed.

2. Data Classification and Handling

JobBox handles several types of information, including profile details, uploaded resumes, generated documents, interview practice data, account identifiers, usage events, and employer workflow records. We classify information based on sensitivity and apply handling rules that fit the type of data involved.

Career materials can contain personal information, education history, employment history, contact details, skills, portfolio links, salary expectations, voice recordings, and other information a user chooses to provide. We handle this data with additional care because it can be personal and professionally sensitive.

• Career Documents: Uploaded CVs, cover letters, portfolios, and generated documents are treated as user-provided career assets and are stored or processed only to support platform features and user-requested workflows.
• Interview and Voice Data: Audio, transcripts, interview notes, scoring outputs, and feedback may be processed to deliver interview practice, coaching, and review experiences.
• Employer Workflow Data: Recruiter, hiring, and job-related records are handled according to access permissions, customer configurations, and applicable product boundaries.
• Administrative Data: Support notes, operational logs, billing references, and audit data are restricted to authorized team members and used for service delivery, security, compliance, and troubleshooting.

3. Encryption and Secure Transmission

We use encryption and secure transport controls to reduce the risk of unauthorized interception or exposure. These controls protect data as it moves between users, JobBox services, storage providers, AI processing systems, and other authorized backend services.

• Encryption in Transit: Data transmitted between the browser, app, API services, and backend processors is protected using secure transport protocols such as TLS.
• Encryption at Rest: Stored data, including supported document assets and database records, is protected using modern cloud storage and database encryption capabilities.
• Secure Uploads: Resume, portfolio, and supporting document uploads are routed through controlled backend paths so access and processing can be governed by platform permissions.
• Secret Handling: API credentials, service tokens, and integration secrets are intended to be stored in protected configuration systems and not exposed in client-side code.

4. Account, Identity, and Access Controls

Access controls help ensure that candidates, employers, mentors, support staff, and administrators can only perform actions appropriate to their role. Different parts of the product may require different permissions depending on whether a user is managing a personal career profile, reviewing applications, providing services, or administering platform settings.

• Authentication: User sessions are managed through authenticated access flows designed to verify identity before protected actions are allowed.
• Role-Based Access: Permissions are separated across candidate, employer, HR, support, admin, and super-admin experiences so privileged actions remain limited.
• Administrative Hardening: Sensitive administrative workflows, such as prompt management, support review, billing operations, and employer controls, are restricted to authorized personnel.
• Session Protection: We use session management practices intended to reduce the risk of unauthorized reuse, stale access, and unintended privilege escalation.

5. Application and API Security

JobBox includes web pages, authenticated product experiences, backend APIs, document processing workflows, AI orchestration, and employer-facing tools. We use application-level controls to protect these surfaces from common risks such as unauthorized data access, injection, broken authorization, and unsafe file handling.

• Input Validation: Forms, uploads, profile fields, search inputs, and API payloads are validated where appropriate before being stored, processed, or passed to downstream services.
• Authorization Checks: Protected routes and API operations should verify the requesting user has permission to access the requested resource or perform the requested action.
• File Processing Controls: Document parsing and conversion workflows are designed to run through controlled services so uploaded files do not receive broad access to the application environment.
• Rate and Abuse Controls: We may use rate limits, monitoring, abuse detection, and other controls to protect login, upload, AI, interview, and public-facing endpoints.

6. AI Infrastructure and Prompt Security

JobBox uses AI to assist with resume analysis, career matching, interview practice, document generation, and coaching. Because AI workflows can involve sensitive career context, we use additional controls around prompt templates, model interactions, and output handling.

• Backend AI Calls: Interactions with AI providers are intended to be made through authenticated backend services rather than exposing provider credentials to the client.
• Prompt Governance: Prompt templates, system instructions, scoring rubrics, and evaluation logic are maintained as internal platform assets and access is limited to authorized team members.
• Context Control: We aim to send only the context required for a feature, such as a resume excerpt, target job description, interview transcript, or selected persona details.
• Output Review: AI-generated recommendations are designed to support user decisions, not replace user judgment, employer judgment, or professional advice where applicable.

7. Vendor and Subprocessor Security

We may rely on trusted infrastructure, analytics, communication, payment, AI, document processing, authentication, hosting, and support providers. We review vendors based on the service they provide, the type of data involved, and the controls available to protect that data.

• Purpose-Limited Use: Vendors are used to provide specific platform functions such as hosting, storage, AI processing, email delivery, payment handling, analytics, or customer support.
• Access Restrictions: Where possible, vendor access is configured to reduce exposure and limit access to the systems, data, or environments needed for the service.
• Provider Review: We consider security posture, privacy terms, reliability, data handling practices, and operational necessity when selecting providers.
• Service Changes: As our platform grows, our vendors and subprocessors may change. We aim to keep such changes aligned with our privacy and security commitments.

8. Monitoring, Logging, and Audit Trails

Monitoring helps us detect reliability issues, suspicious activity, unauthorized access attempts, and operational failures. Logging also supports debugging and security investigations. We balance logging needs with privacy by avoiding unnecessary collection of highly sensitive content where possible.

• Administrative Logs: Sensitive internal actions, permission changes, support activity, and system configuration changes may be logged for accountability.
• Security Events: Login anomalies, failed access attempts, unusual API activity, upload issues, and abnormal service behavior may be monitored.
• Operational Metrics: Performance, uptime, error rates, background job status, and AI workflow health may be tracked to maintain service reliability.
• Log Protection: Logs are intended to be restricted to authorized personnel and used for security, support, compliance, and service improvement purposes.

9. Backups, Availability, and Resilience

We design our infrastructure and operating practices to reduce the risk of data loss, extended downtime, and service interruptions. Availability measures may vary by feature, environment, customer plan, and infrastructure provider.

• Backups: Important platform data may be backed up using cloud infrastructure capabilities so recovery is possible after accidental loss, infrastructure failure, or operational error.
• Recovery Procedures: We maintain operational procedures to assess incidents, restore service, validate affected systems, and communicate material issues where appropriate.
• Service Segmentation: Where practical, background processing, document handling, AI workflows, public web pages, and authenticated product services can be separated to reduce broad impact from localized issues.
• Continuity Planning: We review high-impact dependencies and failure scenarios so platform operations can continue or recover in a controlled way.

10. Employee and Internal Access Practices

Internal access to user information is limited to legitimate business needs such as support, fraud prevention, security investigation, product maintenance, legal compliance, and customer-requested service delivery.

• Need-to-Know Access: Team members should only access user or employer information when their role requires it for a specific operational reason.
• Access Reviews: Administrative and operational access may be reviewed periodically, especially when people change roles, leave the organization, or no longer need a tool.
• Confidentiality: Personnel with access to sensitive platform information are expected to handle it confidentially and in line with company policies.
• Support Boundaries: Support teams may review account or workflow information to resolve user issues, but should avoid accessing unrelated personal content.

11. Incident Response

No online service can guarantee perfect security. If a security issue occurs, JobBox follows an incident response process designed to identify the issue, contain the impact, investigate the cause, restore normal operations, and communicate with affected parties where required.

• Triage: We evaluate reports and alerts based on severity, affected systems, data sensitivity, exploitability, and user impact.
• Containment: Steps may include disabling affected credentials, rotating secrets, restricting access, pausing vulnerable features, blocking abuse patterns, or isolating systems.
• Investigation: We review logs, application behavior, infrastructure events, user reports, vendor information, and affected records to understand what happened.
• Notification: Where legally required or operationally appropriate, we notify affected users, customers, regulators, or partners about material incidents.

12. User Security Responsibilities

Security also depends on how users manage their own accounts, devices, email inboxes, and shared documents. Users should take reasonable steps to reduce account compromise and accidental exposure of sensitive career information.

• Protect Your Account: Use a strong, unique password or secure sign-in method, keep your email account protected, and do not share account access with other people.
• Review Shared Content: Check resumes, portfolios, links, cover letters, and public profile information before sharing them with employers, mentors, or third parties.
• Watch for Phishing: Be cautious of messages asking for passwords, verification codes, payment details, or private documents outside official JobBox channels.
• Report Concerns: If you notice suspicious account activity, unexpected emails, unfamiliar profile changes, or security concerns, contact us promptly.