Security

Last updated: 14 October 2026

Our approach to security

At Cavuno, we take the security of your data and your customers' data seriously. As a multi-tenant platform that hosts job boards for organizations of all sizes, we understand the responsibility that comes with managing sensitive information on your behalf. This page describes the measures we take to protect data across our platform.

Infrastructure and hosting

Cavuno is built on industry-leading cloud infrastructure from providers with strong security track records.

• Application hosting — Our application runs on ISO 27001 certified cloud infrastructure in the United States, with physical security, redundant power and networking, and DDoS protection. TLS certificates are managed and automatically renewed by our application layer.
• Database — Our application data is hosted on Convex using managed cloud infrastructure. Data is protected in transit using TLS and at rest using provider-managed encryption controls.
• Vector search — Semantic search is powered by Qdrant Cloud, which maintains SOC 2 Type II compliance with encryption at rest and in transit.

We do not operate our own data centers. By building on established infrastructure providers, we benefit from their significant investments in physical security, redundancy, and compliance programs.

Data residency

All primary infrastructure, including our database, application servers, search and analytics, is located in the United States. Public assets such as company logos and board images are held in object storage and served from a global CDN.

Backup and disaster recovery

Our primary database is backed up automatically every day at 03:00 UTC. Every backup includes the files held in our application database, including applicant CVs and resumes submitted through job applications. Backups are encrypted, retained for seven days, and cover all customer data in the deployment, giving a recovery point objective of 24 hours. Deployment configuration, environment variables, and pending scheduled functions are not part of database backups and are maintained separately. Semantic search indexes and analytics are derived from the primary database and are rebuilt rather than restored. Public assets in Cloudflare R2 are stored independently of the database backup cycle.

Restores are carried out by our team from any retained backup, into either the affected deployment or a separate deployment for verification before cutover. Restore time depends on the volume of data involved. Because a restore replaces a deployment's data as a whole, recovering a single record or a small set of records is handled case by case rather than through a full restore.

Encryption

In transit

All data transmitted between your browser and Cavuno is encrypted using TLS 1.2 or higher. This applies to all pages, API endpoints, and webhook callbacks. Outbound webhooks Cavuno sends are HTTPS-only; plain-HTTP destinations are rejected. We enforce HTTPS across all connections — HTTP requests are automatically redirected.

At rest

All data stored in our database is encrypted at rest using AES-256. This includes job listings, company profiles, account information, and any other data you store on the platform. Database backups are also encrypted.

Authentication

User authentication is handled through our application auth stack with Convex-backed session data. Passwords are never stored in plain text, and we support multi-factor authentication (MFA) for additional account security.

Session tokens are securely managed using HTTP-only cookies with appropriate SameSite and Secure flags. CSRF protection is enforced on all form submissions.

Multi-tenant data isolation

Cavuno is a multi-tenant platform, meaning multiple customers share the same infrastructure. Customer data is scoped by account in our server functions.

Private data requires an authenticated user with the right account membership and role. Content a customer publishes on its job board, such as job listings and company pages, is publicly readable by design.

Payment security

All payment processing is handled by Stripe. Credit card numbers, CVVs, and other sensitive payment data are submitted directly to Stripe and never touch our servers. Stripe is a PCI DSS Level 1 certified service provider — the highest level of certification in the payments industry.

Development practices

• The codebase is written in TypeScript with strict type checking enabled
• Development and production environments are separated
• Server-side input validation using schema validation on all API endpoints and server actions
• Code review before deployment to catch bugs, security concerns and performance issues
• Signature verification on all incoming third-party webhooks (e.g. Stripe), and Standard Webhooks signing on every outbound delivery Cavuno sends to a customer endpoint
• File upload validation including MIME type checking and file size limits
• Automated dependency and vulnerability scanning, with alerts for known CVEs in production dependencies

Logging and monitoring

Application and infrastructure logs are held with our logging providers. Our server access logs, which include IP addresses, are kept for up to 30 days and then deleted automatically. Security-relevant events are monitored and reviewed as part of our incident response process.

Security headers

Cavuno’s own application sets Strict-Transport-Security (HSTS) with includeSubDomains on its responses, and X-Content-Type-Options on files it serves for download. Sites you build with the AI website builder send the security headers their own code sets; apart from X-Content-Type-Options on shared previews, Cavuno does not add these headers to them.

Access control

Access to production systems is restricted to authorized personnel and governed by the principle of least privilege. SSO and MFA are used when available.

Responsible disclosure

If you believe you have discovered a vulnerability within Cavuno's application, please submit a report to us by emailing hi@cavuno.com. Cavuno does not participate in a bug bounty program at this time, nor do we provide monetary rewards for findings.

We ask that you give us reasonable time to investigate and address the issue before disclosing it publicly. We will acknowledge receipt of your report within 2 business days and aim to provide an initial assessment within 5 business days.

Incident response

If a security incident happens, we contain it, investigate it and fix the cause. If it affects personal data we process for customers, we notify the affected customers without undue delay, as set out in clause 8 of our Data Processing Agreement.

Subprocessors

For a complete list of third-party subprocessors that may process data on our behalf, see our Subprocessors page.

What we don't do (yet)

We believe in being upfront about the boundaries of our security program. As a small team, there are areas we haven't addressed yet:

• We have not completed an independent SOC 2 Type II audit of our own organization. Our infrastructure providers maintain their own security and compliance programs, but we have not pursued our own certification.
• We have not commissioned an external penetration test. We rely on automated vulnerability scanning, code review and internal security assessments.
• We do not operate a bug bounty program or offer monetary rewards for vulnerability reports at this time.

We are actively evaluating these areas and will update this page as our security program matures.

Questions

If you have questions about our security practices or would like to request additional information, please contact us at hi@cavuno.com.