Security Policy

Security is not a feature — it is the substrate. CareerOS-AI is designed to keep your career data private, integral, and available. Our practices are informed by industry frameworks (ISO/IEC 27001, SOC 2, OWASP ASVS) even where formal certification is a work in progress.

• In transit — every connection uses TLS 1.2 or higher with modern cipher suites.
• At rest — application databases and object storage are encrypted at rest by the cloud provider.
• Passwords are stored as bcrypt hashes with a strong work factor.
• Session tokens are signed and short-lived.

• Least-privilege access — CareerOS staff can only access production systems they need for their role.
• All admin console access requires multi-factor authentication.
• Production database access is audited.
• Personal data access by staff is limited to support, safety, and debugging cases and requires justification.

• Rate limiting on authentication and expensive AI endpoints.
• Brute-force lockouts on failed login attempts.
• IP-level anomaly detection for suspicious patterns.
• CSRF and CORS protection on state-changing routes.
• Content-security headers on all pages.

• Automated dependency scanning on the codebase; critical CVEs are patched on a rolling basis.
• Locked, hash-pinned dependencies for reproducible builds.
• Container images are rebuilt regularly to pick up base-image security updates.
• Secrets are stored in environment variables and platform secret managers, never in source control.

• Structured application logging for security-relevant events (logins, admin actions, payment operations).
• Alerts on error-rate spikes and unusual traffic patterns.
• Documented incident-response playbook including containment, eradication, recovery, and lessons-learned.
• In the event of a material security incident that affects you, we will notify you and the appropriate regulators without undue delay, as required by applicable law.

• Automated database backups.
• Point-in-time recovery within our retention window.
• Multi-zone hosting to survive individual data-centre failures.
• Backups are encrypted at rest.

Prompt injection, data exfiltration, and jailbreak attempts are ongoing risks in any AI product. We mitigate them by:

• Never mixing untrusted user content with system-critical instructions in the same context window.
• Structured JSON contracts and validation on AI outputs.
• Logging and reviewing anomalous prompt patterns for abuse.
• Third-party model providers with contractual data-handling obligations (see AI Usage Policy).

• Use a strong, unique password. Consider a password manager.
• Do not share your account credentials.
• Enable multi-factor authentication (MFA) when we offer it.
• Sign out when using a shared device.
• Report suspicious emails claiming to be from CareerOS-AI to support.

If you find a security vulnerability, please report it privately before public disclosure:

Email: security@careeros-ai.com
Alt email: support@careeros-ai.com

We commit to:

• Acknowledge your report within 3 business days.
• Investigate and communicate a remediation plan.
• Not pursue legal action against good-faith researchers who follow this policy.
• Credit you publicly, with your permission, once the issue is fixed.

Please do not run automated scans, load tests, or fuzzers against production without prior written consent. These trigger our abuse-prevention systems and can lead to account suspension. Contact security@careeros-ai.com if you need to coordinate authorized testing.

We update this policy as our infrastructure and practices evolve. The "Last Updated" date reflects the current version. See also our Privacy Policy for data-handling specifics.