Security

Honest snapshot of the current build, not a SOC 2 report. Supports compliance workflow; counsel owns judgment.

What we store

Access-request fields on the server. Demo inventory and notices in the visitor’s browser. Optional ATS keys and a job cache in `.data/` on the machine that runs the Next.js process. Published public summaries are meant to be public.

What we do not do

ATS keys are not written back into API JSON after save. Search engines are told not to index `/app/` or `/api/`. Humans can still open those URLs unless the demo password gate is on.

Production limits

There is no per-company login yet. The Vercel filesystem is ephemeral, so `.data/` is not a customer vault. Do not treat the live demo as an isolated tenant. Auth, org-scoped Postgres, and encrypted secret storage are the next hardening step.

Demo gate

When `DEMO_PASSWORD` is set, `/app` requires that password and an httpOnly cookie. Public audit summaries stay open.

Security notes: hello@hiredocket.com.