Skip to main content
CVSuite.aiLogin

Security

Version 2026-07-12

An overview of the technical and organisational measures that protect data in CVSuite.ai.

Authentication

  • Passwordless sign-in via single-use, time-limited magic links (there are no passwords to leak or reuse).
  • Sign-in is restricted to verified organisation email domains, with abuse controls on sign-in and on AI features.
  • Sessions use secure, HTTP-only cookies and expire after 12 hours of inactivity.

Access control and tenant isolation

  • Student-facing queries are scoped to the signed-in user. Admin queries are scoped to the administrator’s institution.
  • Institution administrators can only see their own institution's data, derived from their verified session - never from client input.
  • Administrator access is granted through a secure, manually-reviewed, version-controlled allow-list.
  • Institution dashboards show aggregate cohort figures only, never individual students, and apply small-number suppression so that figures based on fewer than five students are not shown.

Data protection in use

  • Data is encrypted in transit (HTTPS); data at rest is encrypted where the hosting and database provider supports it.
  • The underlying hosting and database providers (Vercel and Neon) hold ISO/IEC 27001 certification for their infrastructure. This describes their infrastructure and is not a certification of CVSuite.ai itself.
  • Database access is server-side only and never exposed to the browser.
  • When using AI, where contact details are not needed we remove them on a best-effort basis before the text is sent, and responses are not stored by the AI provider in production (see Subprocessors).

Auditing and accountability

Privileged and compliance-relevant actions - administrator access to student data, exports, deletions and AI processing - are recorded in an audit log containing identifiers and counts only, never CV content. The audit trail is designed to survive account deletion.

Regulatory

ICO (UK Information Commissioner's Office) registration: Registration in progress (to be confirmed).

Reporting a concern

Please report any security concern to privacy@cvsuite.ai.