Security

Your candidates' data
is safe with us.

Meritly AI handles sensitive personal data — resumes, contact details, employment histories. We treat that responsibility seriously. Security is built into every layer of the platform, not bolted on afterwards.

Data encryption at rest and in transit

All resume data, candidate profiles, and hiring information is encrypted at rest using AES-256 and in transit using TLS 1.3. No plaintext data is ever stored.

Secure cloud infrastructure

Meritly AI runs on AWS with strict VPC isolation, private subnets, and no public-facing database access. Resume files are stored on S3 with server-side encryption and pre-signed URL access only.

Multi-tenant isolation

Every piece of data — candidates, jobs, chat sessions — is scoped to your company. Strict tenant isolation ensures no data leaks between organisations, enforced at the database query level.

Full audit logging

Every action taken in Meritly AI — shortlisting, status changes, chat interactions, exports — is logged with timestamps and user attribution. Your compliance team will love it.

Resume data privacy

Candidate data is processed and stored only for the purpose of your active hiring. We do not share, sell, or use candidate resumes to train external models.

SOC2-ready practices

Our infrastructure and processes are designed with SOC2 Type II compliance in mind — access controls, change management, incident response, and continuous monitoring.

Technical security practices

  • JWT authentication with 24-hour token expiry
  • bcrypt password hashing (never stored in plaintext)
  • Rate limiting on all public and authenticated endpoints
  • CSRF protection on all state-changing requests
  • Helmet.js HTTP security headers
  • Input sanitisation on all user-provided data
  • Role-based access control (RBAC) per organisation
  • Redis-backed session caching with automatic expiry
  • Environment variable validation at startup
  • Dependency vulnerability scanning

Data residency

All data is stored in AWS us-east-1 by default. Enterprise customers can request a different region. We do not store data outside AWS managed services.

AI model usage

Resume parsing uses Google Gemini via the API. We do not opt in to data training by Google. Resume content sent for parsing is not stored by Google beyond the API request lifecycle.

Vulnerability disclosure

Found a security issue? We take disclosures seriously and respond within 24 hours. Please reach out to security@meritlyai.com.

Questions about security or compliance?

Our team is happy to discuss your specific requirements, provide documentation, or walk through our security architecture.

Contact us