Security at Patorbit
Your resume and career data are sensitive. Here is exactly what we protect today — and what we're still building. No inflated claims.
Encryption in transit
All traffic between your browser and Patorbit is served over HTTPS/TLS.
Password security
Passwords are hashed with bcrypt before storage — plaintext passwords are never stored.
Session-based access control
Every API route checks your authenticated session server-side. Data is scoped to your account.
Payment webhook verification
Razorpay webhooks are verified by signature before any subscription state changes.
Rate limiting
AI and import endpoints are rate-limited per user to prevent abuse.
Data export & account deletion
Export all your data as JSON from settings, or permanently delete your account and its data.
Automated public status monitoring
Real uptime tracking with a public status history.
Formal security audits
Third-party penetration testing and a public bug-bounty program.
SOC 2 certification
We are working toward SOC 2 but are NOT certified today. See our compliance page.
Certifications
Patorbit holds no security certifications today. We do not claim SOC 2, ISO 27001, or any audit attestation. When that changes, we'll publish evidence — not badges.
Your data
- Retention: Your data stays while your account exists. Delete your account and it's removed.
- Export: Download a full JSON copy of your data from settings at any time.
- AI processing: Content you send to AI features is processed by our configured AI provider to generate suggestions. We don't sell your data.
- Subprocessors: Hosting (Vercel), database (Neon/Postgres), payments (Razorpay), sign-in (GitHub, LinkedIn), AI provider (per configuration).
Questions about security?
Contact us directly — we'll answer specifics about how your data is handled.