QuickCruit
Sign inStart freeDashboard
Trust

Security

Last updated · August 18, 2026

The short version

Your resume and your conversations are encrypted in transit and at rest, stored in the United States, and looked at by people only when you ask for help or something is broken. We are a small company: we do not hold a security certification yet, we have not commissioned a third-party penetration test yet, and we have not had a security incident. This page says all of that plainly and will change the day any of it does. If you find a security problem, email contact@quickcruit.ai.

Contents

Certifications and compliance

QuickCruit does not hold SOC 2, ISO 27001, or any other security certification today, and this page will not show a badge we have not earned. What we can say honestly:

  • The providers that run our infrastructure (web hosting, API hosting, the database, file storage, authentication, and payments) each maintain SOC 2 Type 2 or ISO 27001 attestations, or both, for the services we use.
  • Card payments are handled by a payments provider certified to PCI DSS Level 1. Card numbers never reach our servers; we hold a reference to your payment method and its last four digits, nothing more.
  • Your rights under GDPR and CCPA (access, correction, export, deletion, objection) are described in the privacy policy and work from account settings without a support ticket. GDPR and CCPA are laws we follow, not certifications we hold.
  • HIPAA does not apply to QuickCruit. We are not a healthcare provider or a business associate of one, and the product is not built to hold medical records. Please do not put them in it.

When we earn a certification, its name, scope, and date will appear here first.

Encryption

In transit

Every connection to quickcruit.ai, app.quickcruit.ai, and our API uses HTTPS (TLS 1.2 or newer). Both sites send HTTP Strict Transport Security with preloading, so a browser that has seen us once will refuse to connect over plain HTTP. Connections from our servers to the database, to the authentication and payments providers, and to the AI providers are also TLS.

At rest

The database that holds your profile, uploaded resumes, generated documents, tracker, and coach conversations is encrypted at rest by its provider with AES-256, and its backups are encrypted the same way. Secrets our servers use to talk to other systems are held in the hosting provider's configuration, not in source code, and the code repositories are private.

Passwords and sessions

We never see or store your password. Sign-in is handled by a dedicated authentication provider that stores only a salted hash, rate-limits attempts, and issues short-lived signed session tokens that our servers verify on every request. Sign-in with Google is available if you would rather not have a password with us at all.

Where your data lives

Your data is stored and processed in the United States. The database runs in a US East region, the API runs in a US East region, and the websites are served by a US-based hosting provider from US regions. AI processing (coaching, tailoring, matching) sends the relevant text to AI providers in the United States under agreements that forbid training on it. We do not offer regional storage options today.

If you are in the EEA or the UK, that means your data crosses a border. The safeguards we rely on are described under International transfers in the privacy policy.

Who can see your data

Almost all of the work on your data is done by software: the coach, the matching, the tailoring, the honesty check. A person at QuickCruit looks at your account or your content only when:

  • you ask us for help and looking is needed to help you;
  • something is broken or abused and looking is needed to fix or stop it; or
  • the law requires it.

The controls that hold that line: production systems (hosting, the database, secrets) are reachable only by the small team that operates QuickCruit, through the providers' own account controls. The internal admin console is gated by an account role that ordinary accounts do not have and cannot grant themselves. Your content is never used to train AI models, ours or anyone else's, and is never sold or shared with recruiters or advertisers. When you delete your account, one registry drives the removal of every record we hold about you, and the same registry produces the data export in account settings, so the two cannot drift apart.

Reporting a vulnerability

If you believe you have found a security issue in QuickCruit, the product, the browser extension, or the API, please tell us. Email contact@quickcruit.ai with enough detail to reproduce it (a URL, a request, or a screenshot helps). A machine-readable version of this policy is at /.well-known/security.txt.

What you can expect from us:

  • An acknowledgement within three business days.
  • A fix as fast as the severity demands, and a note back to you when it ships.
  • Credit here, by name or handle, if you want it. We do not run a paid bug bounty programme today; if that changes, the terms will be published on this page.
  • No legal action against good-faith research that follows the rules below. If you are unsure whether something is in scope, ask first.

What we ask of you:

  • Only test against accounts you own. Do not read, change, or delete anyone else's data; if you reach it by accident, stop and tell us.
  • No denial of service, no spam, no social engineering of our team or our users, and no physical attacks.
  • Give us a reasonable time to fix the issue before you publish it.

Incident history

None to date. As of the date at the top of this page, QuickCruit has not had a security incident involving unauthorized access to customer data. If that ever changes we will list it here, with the date, what happened, who was affected, and what we changed, and we will notify affected people directly as the law requires.

Security testing

We have not yet commissioned a third-party penetration test. What we do today: an internal security review of the sign-in, sign-up, and password-reset flows, session handling, security headers, cross-origin rules, and webhook verification, most recently completed on August 17, 2026, plus automated test suites covering the product, the API, and the browser extension. When the first third-party test is complete, its date will appear here and a summary of the report will be available on request from contact@quickcruit.ai.

One address for all of it: questions about this document, requests to access, correct, export, or delete your data, and anything a lawyer would want to send us. Email contact@quickcruit.ai. We answer verified requests within the timelines the law sets, and usually a good deal sooner.

Version history

Every change to this document, newest first. The date at the top of the page is the newest entry here.

  1. First published. Says what is encrypted and where your data is stored and processed (United States), who inside QuickCruit can see it and when, how to report a security issue and what we promise in return, that we hold no security certifications yet, that no security incident has affected customer data to date, and that no third-party penetration test has been run yet. Adds a machine-readable security.txt at /.well-known/security.txt on quickcruit.ai and app.quickcruit.ai.