Security

1. Our approach

Jobsistant maintains an information security programme comprising administrative, technical and organisational measures designed to protect the confidentiality, integrity and availability of personal data processed through the service. The programme is proportionate to the nature and sensitivity of that data, is reviewed periodically, and is revised in response to material changes in the service, the threat environment or applicable law.

Security is treated as a design constraint rather than a subsequent control. Safeguards described in section 4 are properties of the product itself: they constrain what the service is capable of doing, not merely what it is permitted to do.

2. Protection of data

• In transit. All communication between your browser, the browser extension and our systems is encrypted using industry-standard Transport Layer Security. Transport security policies are enforced at the network edge, and unencrypted connections are refused rather than downgraded.
• At rest. Personal data, uploaded documents and generated documents are held on encrypted storage. Documents are made available only through short-lived, individually authorised links; they are not published at persistent or publicly enumerable addresses.
• Segregation. Personal data is logically segregated by account, and requests for it are authorised against the identity of the requesting account. Operational data used to improve the service across the user base is maintained separately from personal data and is limited to non-identifying information, as described in section 4.
• Retention. Personal data is retained for as long as your account remains active and for a limited period thereafter, as set out in the privacy policy. Backup copies are encrypted and expire on a defined cycle.

3. Platform and application security

• Changes to the service are subject to review and to automated verification before release. Verification includes checks directed specifically at the product safeguards set out in section 4; a change that would compromise one of them does not reach production.
• The browser extension executes no code obtained at runtime. Support for individual application platforms is delivered as validated configuration data, not as executable content.
• Content encountered on third-party web pages, including job descriptions and form labels, is treated as untrusted input throughout processing. It is never interpreted as instructions to the service.
• Credentials issued to the browser extension are scoped, revocable and independently replaceable. Provider credentials, storage credentials and database credentials are held exclusively within our server environment and are never distributed to client software.
• Dependencies are monitored for disclosed vulnerabilities and updated on a risk-prioritised basis.

The extension is distributed through the Microsoft Edge Add-ons store and the Chrome Web Store, which provide the signed-package and update channel rather than a file downloaded from this site.

4. Safeguards built into the product

The following are standing commitments, enforced by the design and release process of the service rather than by operational discretion.

• No automated submission. The service prepares applications; it does not submit them. It has no facility to transmit an application on your behalf, and we do not intend to introduce one. Submission is an act you perform.
• Restricted data classes. Authentication credentials, human-verification challenges, payment instrument details and government-issued identity numbers are excluded from processing. The exclusion is applied locally, within your browser, before any information is transmitted.
• Grounded generation. Drafted answers are derived exclusively from information you have provided and from the job description presented to you. Drafts are verified against that source material before they may be placed into a form, and a draft that introduces unsupported information is withheld.
• Special category data. Voluntary self-identification information is currently excluded from processing and always left for you. Jobsistant does not infer, save or fill these answers. Any future support would require clear notice and explicit, category-specific opt-in before this information could be processed.
• Non-identifying operational data. Information used to improve form recognition across the user base describes the structure of forms only. It contains no answers, no personal data and nothing attributable to an individual. Analytics events are drawn from a fixed schema of non-identifying values and are keyed to an account identifier.
• No Jobsistant model training. We do not use your content to train a Jobsistant-owned model. AI gateways and model providers receive only the material needed for a feature you request and operate under their applicable data terms, as explained in the privacy policy.

5. Access management

Administrative access to production systems is restricted to personnel who require it, granted on a least-privilege basis, protected by multi-factor authentication, and reviewed periodically. Access to personal data in the ordinary course is not required and is not routinely exercised; where access becomes necessary to investigate a fault or to respond to a request from you, it is limited to what that purpose requires.

6. Resilience

Production data is backed up on a regular schedule to encrypted storage held separately from primary systems. Restoration procedures are exercised periodically. Erasure of an account removes the associated personal data from production systems promptly, and from backup media as those media expire in the ordinary course.

7. Service providers

We engage a limited number of providers for hosting, storage, language-model processing, error monitoring and product analytics. Providers are selected on the basis of their security posture, are bound by written terms governing confidentiality and permitted processing, and are granted only the data their function requires. The categories of provider engaged, and the purposes for which each is engaged, are described in the privacy policy.

8. Incident response

We maintain procedures for identifying, containing, assessing and remediating security incidents. Where an incident affects personal data and gives rise to a notification obligation, we will notify the competent supervisory authority and, where the applicable threshold is met, affected individuals, within the periods prescribed by applicable law. Notifications will describe the nature of the incident, the categories of data involved, the measures taken and the measures recommended to you.

9. Responsible disclosure

We welcome reports from the security research community. Please write to [email protected] with “security” in the subject line, describing the finding and the steps required to reproduce it. Reports are acknowledged and triaged on receipt, and we will keep you informed of remediation.

Research should be conducted only against accounts and data belonging to you, without accessing, altering or exfiltrating the data of others, and without degrading the availability of the service for other users. Where research is conducted within those limits, is reported to us promptly, and the finding is not disclosed publicly before remediation, we will not pursue or support legal action in respect of it.

10. Compliance posture

Our control framework is informed by generally accepted industry practice and by the obligations applicable to us under data protection law. Where a formal assurance report becomes available, it will be published here.

11. Your controls

Security is not solely something exercised on your behalf. The dashboard lets you inspect and amend supported profile information. You may also turn the extension off, revoke its site access, sign out, and request a portable copy or account erasure through our privacy contact. The available controls and request process are set out in the privacy policy.

12. Contact

Enquiries concerning this statement, including security questionnaires and diligence requests, may be directed to [email protected].