Skip to main content
CVSuite.aiLogin

Security

Version 2026-08-03

An overview of the technical and organisational measures that protect data in CVSuite.ai.

Authentication

  • Passwordless sign-in via single-use, time-limited magic links (there are no passwords to leak or reuse).
  • Sign-in is restricted to verified organisation email domains, with abuse controls on sign-in and on AI features.
  • Sessions use secure, HTTP-only cookies and expire after 12 hours of inactivity.

Access control and tenant isolation

  • Student-facing queries are scoped to the signed-in user. Admin queries are scoped to the administrator’s institution.
  • Institution administrators can only see their own institution's data, derived from their verified session - never from client input.
  • Administrator access is granted through a secure, manually-reviewed, version-controlled allow-list.
  • Institution dashboards show aggregate cohort figures only, never individual students, and apply small-number suppression so that figures based on fewer than five students are not shown.

Data protection in use

  • Data is encrypted in transit (HTTPS); data at rest is encrypted where the hosting and database provider supports it.
  • The underlying hosting and database providers (Vercel and Neon) hold ISO/IEC 27001 certification for their infrastructure. This describes their infrastructure and is not a certification of CVSuite.ai itself.
  • Database access is server-side only and never exposed to the browser.
  • When using AI, where contact details are not needed we remove them on a best-effort basis before the text is sent, and responses are not stored by the AI provider in production (see Subprocessors).

Auditing and accountability

Privileged and compliance-relevant actions - administrator access to student data, exports, deletions and AI processing - are recorded in an audit log containing identifiers and counts only, never CV content. The audit trail is designed to survive account deletion.

Regulatory

CVSuite.ai is operated by Kennington Applied LTD, registered in England and Wales, company number 17327812 at Companies House (opens in a new tab). It is registered with the ICO (UK Information Commissioner's Office) as a data protection fee payer under reference ZC208807 on the Information Commissioner's Office register (opens in a new tab).

Reporting a concern

Please report any security concern to privacy@cvsuite.ai.