Security

Data isolation

Every user-owned table enforces row-level security policies scoped to the authenticated user's ID. A request carrying your session can only ever read or write your own rows — isolation is enforced by the database, not by application code alone.

Transport and storage

All traffic is served over TLS. Data at rest lives in a managed Postgres instance with encryption enabled and automated backups.

Authentication

Email and password sign-in uses hashed credentials and confirmed email addresses; Google sign-in uses OAuth so we never see your Google password. Sessions are refreshed with short-lived tokens.

Secrets and AI access

AI and job-provider credentials are stored as server-side secrets and are never exposed to the browser. AI calls are made from the server, scoped to the signed-in user.

Least privilege

Privileged database roles are used only for administrative operations, never for ordinary reads, and role membership is stored in a dedicated table so it cannot be escalated from a user-editable profile.

Reporting an issue

Found a vulnerability? Email security@hirely.app with the details. We will acknowledge within three business days and will not pursue action against good-faith research.