1. Our security posture
- Row-level security: every user-scoped table in our database enforces row-level policies so users can only read and modify their own records.
- Authentication: we use signed JWTs with the Supabase signing-keys system, with email/password and Google OAuth sign-in. Password reset links are scoped to our production domain.
- Encryption in transit: all traffic to the application, database, and storage is encrypted with TLS.
- Payments: we never see or store full payment card details. All payments are processed by Paddle, our Merchant of Record. Subscription state is updated only through cryptographically-signed Paddle webhooks.
- Private file storage: uploaded résumés and claim documents live in private storage buckets accessible only to the owner via short-lived signed URLs.
- Least privilege: server-side keys are scoped to edge functions and never shipped to the browser. Trigger and helper database functions are not callable by anonymous clients.
- Employer isolation: employer-sponsored seat purchasers cannot read employees' individual claim, journal, mood, financial, application, contact, AI Coach, or Strength Map data. Aggregate outcome reporting is hidden until at least ten people have reported a hire.
2. Reporting a vulnerability
If you believe you have found a security vulnerability in Pivot Companion, please report it privately to info@ozaspro.com. Please include:
- A description of the issue and its potential impact.
- The steps required to reproduce.
- Any proof-of-concept material, if applicable.
We aim to acknowledge reports within two business days. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.
3. Safe-harbor commitment
Good-faith security research that respects user privacy, avoids data destruction, and gives us a reasonable disclosure window is welcomed. We will not pursue legal action against researchers who follow these principles.