Security

RaetOS stores sensitive career information: work history, resumes, captured job postings, generated application packets, and tracker records. Security decisions are designed around protecting that account-owned data and keeping access scoped to the right user.

This page describes the current security posture of the product. It avoids certification or audit claims that RaetOS has not completed.

• Passwords are hashed with Argon2 before storage. Plaintext passwords are not stored.
• Access tokens use JWTs with refresh-token support for continued sessions.
• Refresh tokens are stored server-side as token hashes and can be revoked.
• Authentication cookies are configured as HttpOnly, Secure, and SameSite where supported by the deployed environment.
• Cloudflare Turnstile is used on login and signup flows to reduce automated abuse.
• Google and Microsoft sign-in use identity scopes only. RaetOS does not receive your Google or Microsoft password.

• Application API requests require an authenticated user before protected account data is returned.
• Database reads and writes for user-owned records are scoped by user identity.
• Server-side validation is used before account, profile, queue, packet, resume, tracker, and settings data is saved.
• Database credentials, OAuth secrets, JWT secrets, API keys, and other sensitive configuration belong in environment secrets, not source code.
• RaetOS uses PostgreSQL-backed storage for account and career records.
• Administrative access is limited to operational use and should be treated as sensitive account activity.

The RaetOS extension is designed to send job-posting details to My Queue when you choose to capture a posting.

• The extension should capture job-posting data needed for My Queue and Decision Engine review.
• The extension is not intended to read Gmail or Outlook inbox content.
• Extension access can be disconnected by signing out of the extension or revoking extension sessions from Settings.
• Local sent-board counters can be cleared without deleting queue items already saved to the RaetOS account.

RaetOS uses AI for product features such as job-posting analysis, resume generation, application packets, ATS text, cover letters, and career-record enrichment.

• AI requests should include only the content needed for the selected action.
• AI-generated outputs are drafts and should be reviewed before use.
• RaetOS does not claim that AI providers retain no data unless that is confirmed by the active provider terms and configuration.
• RaetOS does not use Google or Microsoft sign-in data to train generalized AI models.

RaetOS is still growing. The current security page should describe controls that are actually in place, not future certifications or planned tools.

• In place: password hashing, JWT access tokens, refresh-token revocation, identity-only OAuth, Turnstile on auth flows, user-scoped data access, server-side validation, and environment secrets.
• Future certifications, audits, infrastructure protections, and security tools will be documented after they are built, tested, and operating.
• Planned security tooling should be documented after it is built, tested, and operating.

If RaetOS confirms a security incident affecting personal data, we will investigate, take steps to contain the issue, and notify affected users or regulators when required by applicable law.

This page does not promise a fixed notification timeline until the incident-response tooling and operating process are built and tested.

For security questions or vulnerability reports, contact [email protected].

For privacy or data requests, contact [email protected].

Related pages: Privacy Policy, Terms of Service, and Cookie Policy.