Security

An uploaded resume is read into memory, parsed, and discarded when the request ends. The file itself is never written to disk on our servers, and there is no bucket of past uploads to breach.

Authentication is Amazon Cognito using the authorization code flow with PKCE. The code exchange happens on the server; the identity token is stored in an httpOnly, SameSite cookie that page JavaScript cannot read, which keeps a cross-site scripting bug from turning into a stolen session.

Every request that touches candidate data verifies that token’s signature against the user pool’s published keys, along with its issuer, audience, and expiry.

An upload starts with this application: it checks the session and issues a signed ticket that expires after five minutes. The browser spends that ticket on one upload to the extraction engine, which rejects any request without a valid one. If that connection fails, the file goes through this application’s own endpoint instead, which performs the same checks. No engine key is ever sent to the browser.

The structured record from each extraction is kept in an Amazon DynamoDB table in US East (Ohio), encrypted at rest with AWS-managed keys and covered by point-in-time recovery. Only the extraction service can write to it, and only this application can read it, each through its own least-privilege role.

The talent heat map reads those records but shows only employer, job title, skills, years of experience, and location. Names, email addresses, and phone numbers are never shown on the map or included in its exports.

• TLS on every connection.
• Extracted records at rest are encrypted; resume files are never stored.
• The copy of a record in your browser can be cleared at any time.
• Secrets are held as deployment environment variables, never in the client bundle.

Send details to oceanbluesolutions@gmail.com. Please give us a reasonable window to fix an issue before disclosing it. We will not pursue action against good-faith research that avoids privacy violations and service degradation.