Security & Compliance

• HTTPS everywhere, with HSTS.
• Two-step verification for every password sign-in (email code, authenticator app or passkey); a device can be remembered for 30 days. Google, GitHub and LinkedIn sign-ins rely on that provider's own checks and accept only an email address the provider has verified.
• Sign-in tokens kept in secure, httpOnly cookies that page scripts can't read.
• Repeated failed sign-ins lock out further attempts; bot protection on sign-up and forms.
• Resumes stored privately and downloaded through time-limited links, and shared only with employers you apply to or approve.
• Credentials for connected applicant tracking systems encrypted at rest.
• Enterprise single sign-on limited to verified company domains.

We don't hold security certifications such as SOC 2. Your privacy rights are described in our Privacy Policy and California Privacy Notice.

If a breach affects your personal data, we will notify you without undue delay and as required by applicable law.

Responsible disclosure: security@tensorhunt.com. Please do not publicly disclose vulnerabilities before we have had a chance to address them.