Your career data deserves enterprise-grade protection.
Neuradesk.ai handles sensitive career information: resumes, salary data, interview recordings, professional networks. We treat security as a core product feature, not an afterthought. Here's exactly how we protect your data.
Encryption
All data in transit is encrypted with TLS 1.3 (HTTPS enforced site-wide).
Data at rest is encrypted using AES-256 on our PostgreSQL databases.
Authentication tokens use signed, HttpOnly, SameSite cookies. They are never exposed to JavaScript.
Authentication & Access
OAuth 2.0 via Google, GitHub, and LinkedIn. We never see or store your social passwords.
Email/password accounts use bcrypt hashing with per-user salts (cost factor 12).
Session management via NextAuth with CSRF protection on every request.
Rate limiting on all API endpoints to prevent brute-force attacks.
Infrastructure
Hosted on Vercel's global edge network with automatic DDoS protection.
Database hosted on Neon PostgreSQL with encrypted connections and automated backups.
No SSH access to production: all deployments via CI/CD pipeline from version-controlled code.
Environment secrets are encrypted and never committed to source control.
Security Headers
Content Security Policy (CSP) restricts script and resource origins.
HTTP Strict Transport Security (HSTS) with 1-year max-age and preload.
X-Frame-Options: SAMEORIGIN. Cross-origin framing is blocked, which is the clickjacking threat; same-origin embedding stays available for in-app PDF preview.
Permissions-Policy restricts camera, geolocation, and microphone access.
AI Data Handling
Your resume and career data is sent to third-party AI providers only when you use AI features. We route to Google Gemini, DeepSeek, Anthropic, OpenAI, and Groq.
We route each task to the provider best suited to it and send what that task needs, which for resume features is your full resume text.
Each provider processes data under its own published API terms. We list every provider we route to rather than claim retention terms we have not contracted for.
Some AI results persist by design so you can revisit them: ATS scores and resume analyses are written when an analysis runs, and a LinkedIn analysis stores the profile text you submitted alongside the result.
Compliance
OWASP Top 10 security practices implemented across all API routes.
GDPR-compliant data handling with right to access, correction, and deletion.
Indian IT Act 2000 and DPDP Act 2023 compliance.
Zod schema validation on API request bodies, required for every new or revised endpoint. Coverage across the older surface is still expanding and is tracked internally.
Input sanitization on all AI prompts to prevent prompt injection.
Responsible Disclosure
Found a security vulnerability? We appreciate responsible disclosure. Please report it to security@neuradeskai.com with details of the issue. We will acknowledge receipt within 24 hours and work with you to address it promptly.
Please do not publicly disclose vulnerabilities before we've had a chance to address them.