Security

This page describes measures that are actually implemented. No online service can be called unbreakable. Aplara has not yet had an independent penetration test and holds no security certification. Before release, we ran structured security reviews and automated attack tests against the code and a test copy of the site, and fixed what they found.

Accounts

• Passwords are held only by our authentication service; Aplara never stores them.
• Email verification on sign-up, and single-use, short-lived password reset links.
• A Cloudflare security check on account creation to stop automated sign-ups.
• Resetting a password signs out other sessions.
• Multi-factor authentication is available to everyone and mandatory for administrators.
• Rate limits on sign-up, sign-in failures, password resets, uploads and exports.

Your data

• Every record carries an owner, and the database refuses reads and writes across accounts.
• CV files live in private storage under your own namespace with random object names, reachable only through short-lived links issued to you.
• Uploads are re-checked on the server for type, size, real file signature and filename safety, and screened for malware before use; executables and disguised files are rejected.
• Encrypted backups expire automatically: database backups after 7 days, CV file backups (kept in the EU) after 35 days.
• Administrator actions are recorded in an audit log, and security events raise alerts to our team.

Payments

Card details are handled entirely by Stripe. Payment events are verified by signature and processed once, so a replayed message cannot change your subscription.

AI

Your content is treated as untrusted input: generated claims are checked against your own recorded evidence, and attempts to manipulate the model through pasted job text are resisted.

Reporting a vulnerability

Email support@aplara.com with "Security" in the subject. Please do not access other people's data while testing, and give us reasonable time to fix an issue.