Security

At Scoutly, the confidentiality of your resume, career documents, and personal credentials is our highest priority. We have architected our platform with a defense-in-depth security approach, ensuring that your candidate data remains isolated, encrypted, and strictly under your control at all times.

Our platform enforces strong multi-tenant boundaries and granular access controls across all services:

• Multi-Tenant Database Isolation: Candidate records, tailored resumes, and application trackers are isolated by unique user UUIDs in PostgreSQL with foreign key enforcement and row-level integrity checks.
• Secure Token-Based Authentication: Sessions utilize industry-standard JWTs with short expiry, cryptographic signature verification, and Argon2id password hashing. Multi-factor authentication (TOTP and Email 2FA) is supported.
• Stateless AI Processing: Prompt generation for resume tailoring is strictly decoupled. We never allow third-party model providers to retain or train on your private career history.

We protect your data across all states through modern cryptographic standards:

• Encryption in Transit: All HTTP traffic and API communications between your browser, our Chrome Extension, and the API require TLS 1.3 encryption.
• Encryption at Rest: Generated documents, resumes, and database volumes are encrypted using industry-standard AES-256 encryption.
• Payment Security: Payment transactions and subscription billing are processed directly through Stripe PCI-DSS Level 1 compliant infrastructure. We never store credit card numbers on our servers.

We appreciate the security research community. If you discover a vulnerability in Scoutly, please report it to us privately before making any public disclosure so we can review and remediate it promptly.

Please send vulnerability reports to security@scoutly.in. We respond to all verified security reports within 48 hours.