Hireed AI
Security & privacy

Private by default. Hardened on purpose.

Your searches and saved jobs stay scoped to your account, nothing about your job hunt is sold or handed to ad networks, and every request path is locked down deliberately. Here's exactly how.

Start searching How it works
None Job-search data sold or shared with anyone
0 Third-party ad networks or ad trackers
HttpOnly Session token cookie, unreadable by page scripts
Per account Every data query scoped to the signed-in user's id
Your data

What we keep, and what we never touch

Hireed AI only needs two things to be useful: what you're looking for, and which roles you decided to keep. Both live in your own records, tied to your account, and neither one leaves for an advertiser.

  • Searches and saved jobs live in database records scoped to your account
  • No third-party ad networks or ad trackers on your job-search data
  • No password to store — sign-in runs through Clerk and Google OAuth
  • Camera, microphone and location are denied by response policy
Controls in place

The specifics, header by header

Rather than describe the posture in the abstract, here are the actual controls the app applies — the response headers it sets, how sessions are held, what limits requests hit, and how untrusted content is handled.

01 — Transport & response headers

Set on every response, not just the marketing pages

Content-Security-Policy
default-src 'self' with base-uri 'self', object-src 'none' and frame-ancestors 'none', so the page can't be framed and can't be talked into loading off-origin plugins or code.
Strict-Transport-Security
max-age=31536000; includeSubDomains, sent over HTTPS connections so the browser refuses to downgrade to plain HTTP afterwards.
X-Content-Type-Options
nosniff — the browser honours the content type we declare instead of guessing one from the bytes.
X-Frame-Options
DENY — a second, older-browser layer of the same anti-clickjacking rule the CSP already sets.
Referrer-Policy
strict-origin-when-cross-origin — following a link out never leaks the full path you were on.
Permissions-Policy
camera=(), microphone=(), geolocation=() — explicitly denied, not merely unused.
02 — Sessions & sign-in

Your session can't be read by page scripts

identity provider
Sign-in is handled by Clerk, a dedicated identity provider, plus server-side Google OAuth. Hireed AI never stores your password.
HttpOnly
The Clerk session token cookie is HttpOnly, so client-side JavaScript can never read it. A separate marker cookie, which carries nothing sensitive, only tells the header UI that you're signed in.
SameSite=Lax; Secure
Session cookies are Secure by default and aren't sent along with cross-site requests.
require_auth
Every authenticated endpoint sits behind the decorator, and every data query underneath it is scoped to the signed-in user's id.
Cache-Control
Responses that can carry user-specific data are sent no-store, no-cache, must-revalidate, private when auth cookies are present, so shared and proxy caches never retain them.
03 — Database access

Queries can't be steered, and content can't execute

parameterized SQL
Every statement is parameterized. User input is passed as a value, never concatenated into the query text.
user_id scoping
Reads, updates and deletes are filtered by the signed-in user's id, so one account's request can't reach another account's rows.
text, not markup
Scraped job titles and descriptions are untrusted. They're loaded as JSON and rendered as text, so a hostile listing can't smuggle in script that runs in your browser.
04 — Request hardening

Limits that apply before any handler runs

MAX_CONTENT_LENGTH
Request bodies are capped, so an oversized payload is rejected instead of being read into memory.
per-caller rate limiting
The sensitive paths are rate limited per caller: chat, scrape start and ingest, the OAuth callback, and per-site tests.
05 — Untrusted input

An untrusted link never becomes a blind server request

Job links arrive inside third-party HTML, which makes them attacker-influenced input. Before the server fetches any of them, the target host has to survive a chain of checks — and the chain is built to fail closed, so an unresolvable or ambiguous host is blocked rather than assumed safe.

  • Non-http(s) schemes and private, loopback or link-local addresses are refused
  • Single-label internal hostnames are blocked outright
  • A DNS failure blocks the fetch instead of letting it through
  • Every redirect hop is re-validated, so a chain can't be steered inward
Your controls

Anything you searched, you can remove

Deleting your own history shouldn't require a support ticket. Every record a search creates can be cleared from the workspace, by you, whenever you want.

  • Clear your search history from the workspace
  • Delete saved jobs once you're done with them
  • Delete a whole search session, and everything inside it
  • Log out from account settings to end the session
  • Your theme choice stays on this device, not in your profile
Denied by policy
Camera Denied
Microphone Denied
Location Denied
Embedding in a frame Denied
Off-origin scripts Denied
Straight answers

What we don't claim

Security pages are easy to inflate. These are the things Hireed AI has not done yet, stated plainly, so you can judge the rest of this page on the same terms.

certifications
No SOC 2, ISO 27001 or GDPR certification is claimed. Nothing on this page has been reviewed or attested by a third-party auditor.
availability
No uptime figure is published, because none is measured against a formal service-level agreement.
bug bounty
There's no paid program and no rewards table. Reports are still read, reproduced and fixed.

Found a vulnerability? Send it through contact & support with the affected URL and the steps to reproduce it. Please give us a chance to ship a fix before publishing the details.

Questions

The things people ask first

No. Sign-in is handled by Clerk, a dedicated identity provider, plus server-side Google OAuth — so there's no password for Hireed AI to store or read.

No. Your searches and saved jobs are never sold or shared, and there are no third-party ad networks or ad trackers involved in your job-search data.

No. Authenticated endpoints are gated by a require_auth decorator, and every query is scoped to the signed-in user's id — so a request can only ever return that account's own rows.

Scraped titles and descriptions are treated as untrusted data: they're loaded as JSON and rendered as text rather than injected as markup. On top of that, the content security policy is default-src 'self' with object-src 'none', so off-origin code has nowhere to load from.

Not today. There's no SOC 2, ISO 27001 or GDPR certification to point at, and we'd rather say so than imply otherwise. What's described on this page is what the application actually does — you can report anything you find through contact & support.

Ready when you are

Search first, configure nothing

Start searching How it works