Security
Security at Veraxis.
The measures actually in place today, stated plainly — pre-launch, no compliance certifications yet.
Data isolation
Every product table carries PostgreSQL row-level security: candidates read only their own rows, recruiters only their own jobs and shortlists. Internal admin/monitoring tables go further — deny-all policies, readable only through the server with an explicit admin allowlist.
Admin access
Internal dashboards are gated per-page on the server, not just at the layout level — a hardening we added after proving soft client-side navigation could outlive a revoked session. That gate is backed by an automated browser regression test that performs a real soft navigation after revocation, and the test is mutation-verified (removing the gate makes the test fail).
Transport & storage
TLS on every hop — browser to app, app to database, app to AI providers. Resumes live in a private bucket accessible only via short-lived signed URLs scoped to the owner. Passwords are hashed by Supabase Auth (bcrypt); Google sign-in is available; email verification is required before product access.
Secrets & patching
Service credentials exist only server-side and are never shipped to the browser. We track framework CVEs — Next.js was patched for CVE-2025-29927 (middleware auth bypass) ahead of any impact.
AI providers
Requests to Anthropic run under API terms that exclude training on our data.
What we don't claim yet
No SOC 2 / ISO 27001, no external penetration test, no bug bounty — we’re pre-launch and say so. Found something? security@veraxis.work