Security

Kazifi holds documents (resumes, cover letters, application notes) that are personal and competitively sensitive. Security is therefore a product feature, not an afterthought.

This page describes how we protect that data. It's also where we keep our responsible-disclosure programme.

Every connection to Kazifi is over HTTPS with TLS 1.2 or higher. HSTS is enabled with a 1-year max-age. We get an A grade or higher on industry-standard SSL audits.

The primary database, object storage, and backup snapshots are encrypted at rest using AES-256. Encryption keys are managed by our cloud provider's KMS and rotated automatically.

Engineers operate on a least-privilege model. Production database access requires SSO with two-factor enforcement and is logged. Direct production database access for ad-hoc queries is disallowed. All access goes through audited tooling.

We do not give third parties or contractors access to production data unless contractually required for a specific support task, and even then access is time-boxed and logged.

Passwords are hashed with bcrypt at a high work factor; we never store them in plaintext. Refresh tokens are httpOnly, Secure, and SameSite-strict cookies. We rate-limit login attempts and lock accounts after repeated failed attempts.

OAuth via Google and GitHub uses authorization-code flow with PKCE.

When you trigger an AI rewrite or generation, we send the minimum necessary text to a large-language-model provider with enterprise-grade no-training terms. We don't send your account identifier, billing data, or other documents alongside the prompt unless you explicitly chose to "tailor from resume".

See Privacy → AI providers for the current list.

Every database query is scoped by user (or organisation, for bulk plans). Row-level checks run in both the application and the database layer. You will not see another user's documents.

If we detect a security incident materially affecting user data, we will notify affected users by email without undue delay, and in any case within the timeframes required by GDPR / CCPA where they apply. Post-mortems are published publicly when the lessons are useful.

If you find a security issue, please report it to security@kazifi.co. We commit to:

• Acknowledging your report within 48 hours.
• Working with you on a sensible disclosure timeline.
• Not pursuing legal action against good-faith researchers who act within scope.
• Crediting you publicly in the changelog if you'd like.

Out of scope: denial-of-service, social engineering, attacks requiring physical access to a user's device, and reports purely from automated scanners.

We are not yet SOC 2 audited. We've designed our controls to match SOC 2 Type II principles (access logging, encryption, change management, vendor review) and intend to pursue formal audit as the company grows.

Existing alignment: GDPR and CCPA for user rights; standard contractual clauses for any cross-border data flow.

Security questions or vulnerability reports: security@kazifi.co. PGP key on request.