Security & data handling.
Your candidates' resumes are sensitive. We treat them that way — encrypted in transit, encrypted at rest, processed in our own pipeline, and never shared with any third-party AI service.
Encrypted everywhere
TLS 1.3 in transit (browser → API). AES-256 at rest for files (Tigris S3). MySQL row-level encryption for PII fields like phone numbers.
In-house AI pipeline — no third-party AI
We do NOT send your candidates' resumes to OpenAI, Anthropic, Google, or any other third-party model. The ranking engine runs on our own infrastructure (our own model + our proprietary rubric). Resumes never leave our VPC.
Signed download URLs only
Resume files are not directly accessible. Every download requires a fresh signed URL with a 1-hour TTL. There are no public bucket paths.
Per-tenant isolation
Every query in the app is scoped by company_id. You cannot accidentally see another company's data — we tested this with 50 cross-tenant attack vectors in our test suite.
Audit log of every action
Every login, signup, job create, resume upload, payment, and config change is recorded with user_id, IP, and user-agent. You can request your audit log export any time.
DPDP Act 2023 compliant
India's Digital Personal Data Protection Act applies. We honour data principal rights: access, correction, erasure. Nominate a contact at hello@qubith.in for DPO requests.
Data retention & deletion.
Active accounts. We keep your resumes, jobs, and rankings for as long as your account is active. You can delete any job, candidate, or your entire account from the dashboard at any time.
Cancelled accounts. Account data is purged within 30 days of cancellation. Resume files are deleted immediately on request. Anonymised aggregate metrics (e.g. "Indian tech sector median time-to-hire") may be retained indefinitely.
Backups. Encrypted daily backups are retained for 14 days, then deleted. Backups live in the same region as production (ap-south-1 Mumbai).
Sub-processors. We use AWS Mumbai (compute + storage), Cloudflare (DNS + CDN), Razorpay (payments), Google Workspace for transactional email. None of them receive candidate resume content.
Got a security question?
Email hello@qubith.in for our security questionnaire (CAIQ, SIG, custom). We respond within 24 hours on business days.