Security and Data Breaches

Last updated: 11 November 2026

Your resume, work history and job applications are personal. This page explains how we protect them, in concrete terms, and what we will do if something goes wrong.

1. How we protect your data

In transit and at rest

  • Every connection uses HTTPS (TLS). Browsers are told to use only HTTPS (HSTS).
  • Our database and file storage are hosted by Supabase in Singapore, on encrypted disks.
  • Hiring-site passwords and job-inbox security codes have an extra layer of encryption (Fernet), under a key kept separate from every other secret.
  • Passwords for your Pamposhun account are stored only as one-way hashes by our sign-in provider. We cannot see them.

Access

  • Database rules (row-level security) stop one user's data being read through another user's session. The server-side key that can bypass these rules is never sent to browsers.
  • Staff tools require a separate admin role and two-factor sign-in, and admin actions are logged.
  • You can turn on two-factor sign-in for your own account in Settings.
  • When you reset your password, every other signed-in session is ended.

The application

  • Protection against common web attacks: a strict Content Security Policy, CSRF tokens on every form, HTML cleaning of user text, and checks on the real contents of uploaded files.
  • Rate limits and a bot check (Cloudflare Turnstile) protect sign-up and sign-in from automated attacks.
  • Session cookies are Secure, HttpOnly and SameSite.
  • Before each release, automated scans check the code for security bugs and leaked secrets, and check software libraries for known vulnerabilities.
  • Text from job postings and resumes is treated as untrusted when it is sent to AI models.
  • The agent can mark an application as submitted only with captured proof, and it never retries a submission that may already have reached an employer.

Monitoring and recovery

  • Errors and failed health checks are recorded and sent to us by email within minutes.
  • The database is backed up every day. Backups are kept for 14 days in private storage, with a recovery copy on the founder's computer for 60 days.
  • We collect only the data we need, and delete it on a schedule. See Data Retention.

No system is perfectly secure. If we learn of a weakness, we fix it as a priority.

2. If there is a data breach

A personal data breach is any unauthorised access to, or loss, change or disclosure of, personal data. If one happens, this is what we do. The clock starts when we first become aware, not when we finish investigating.

  1. Contain it straight away: close the gap, change exposed keys and passwords, and end sessions that may be affected.
  2. Assess it: what data, whose, how it happened, and the realistic risk to the people affected. We keep the evidence.
  3. Tell you without delay. If your data is affected, we email you in plain language: what happened and when, what data was involved, the possible consequences, what we have done, what you can do to protect yourself, and who to contact.
  4. Tell the regulators: the Data Protection Board of India without delay, with a full report within 72 hours (DPDP Rules 2025 rule 7). Where the GDPR applies and there is a risk to people's rights, also the relevant supervisory authority within 72 hours.
  5. Fix the cause, not just the symptom. We review what happened and update our safeguards.

We will not play down a breach or delay telling you to protect our reputation.

3. Reporting a security problem

If you find a vulnerability, please email privacy@pamposhun.com with the subject "Security report". Include enough detail for us to reproduce it. We will confirm receipt within 48 hours and keep you updated until it is fixed.

Please test only against your own account. Do not access, change or delete other people's data, do not degrade the service for others, and give us reasonable time to fix the problem before you share it publicly. If you follow these rules and act in good faith, we will not take legal action against you for your research.

If you think your own account has been accessed by someone else, change your password at once (this signs out every other session) and email us.

Questions? Email privacy@pamposhun.com. This page is written in plain English on purpose; if anything is unclear, ask us and we will explain.