Security & Data Privacy
Last updated:
Scoutly's security model — AES-256 encryption, zero LLM training guarantees, and candidate data isolation.
Core Security Principles
Candidate data—including contact phone numbers, employment history, compensation records, and references—is deeply sensitive. Scoutly operates under four fundamental security axioms:
- Candidate Ownership — you own 100% of your career data. We will never sell, broker, or monetize your resume to advertisers or third parties.
- Zero Model Training — your profile content is never used to train, evaluate, or fine-tune public AI foundation models.
- Defense-in-Depth — authenticated AES-256 encryption at rest, TLS 1.3 in transit, and strictly scoped JWT access tokens.
- Human Review Before Submit — Scoutly never auto-submits job applications without your explicit review and confirmation.
Data Encryption at Rest and in Transit
All data transmitted between your browser, the Chrome Extension, and the Scoutly cloud is protected using bank-grade TLS 1.3 encryption with modern cipher suites.
Your sensitive personal identifiers and contact information are encrypted at rest using authenticated AES-256-GCM. Passwords are never stored in plain text, protected by modern cryptographic hashing with per-user salt rotation.
Zero LLM Training Guarantee
When you generate a tailored resume or STAR interview answers, Scoutly transmits prompts to enterprise-tier LLM providers operating under strict Zero Data Retention (ZDR) agreements.
Your data is processed in volatile memory only for the duration of the API call (typically < 2 seconds) and is immediately expunged. It is never logged to disk or accessible to human data annotators.
Browser Extension Security Scoping
The Scoutly Chrome Extension uses Google Chrome Manifest V3:
- No Broad Web Access — the extension only interacts with the currently active tab when you explicitly trigger form autofill or job clipping.
- Client-Side Processing — form heuristic analysis runs locally within your browser, not on a remote scraping server.
- No Keystroke Logging — the extension does not attach global DOM listeners to monitor unrelated browsing.
Vulnerability Disclosure
If you discover a potential security vulnerability in Scoutly, please report it responsibly to our security team at security@scoutly.in. We investigate all legitimate reports promptly and coordinate responsible disclosure timelines.