Security

Last updated: 1 March 2026

Our approach to security

At Cavuno, we take the security of your data and your customers' data seriously. As a multi-tenant platform that hosts job boards for organizations of all sizes, we understand the responsibility that comes with managing sensitive information on your behalf. This page describes the measures we take to protect data across our platform.

Infrastructure and hosting

Cavuno is built on industry-leading cloud infrastructure from providers with strong security track records.

• Application hosting — Our application is hosted on Hetzner Cloud in their Ashburn, Virginia (ash-dc1) data center. Hetzner is ISO 27001 certified and provides physical security, redundant power and networking, and DDoS protection. TLS certificates are managed and automatically renewed by our application layer.
• Database — Our application data is hosted on Convex using managed cloud infrastructure. Data is protected in transit using TLS and at rest using provider-managed encryption controls.
• Vector search — Semantic search is powered by Qdrant Cloud, which maintains SOC 2 Type II compliance with encryption at rest and in transit.

We do not operate our own data centers. By building on established infrastructure providers, we benefit from their significant investments in physical security, redundancy, and compliance programs.

Data residency

All primary infrastructure is located in the United States (US East). This includes our database (Convex, AWS us-east-1), application servers (Hetzner, Ashburn, Virginia), vector search (Qdrant, us-east-1), and analytics (Tinybird, us-east-1). Public assets such as company logos and board images are held in Cloudflare R2 object storage and served from Cloudflare's global network.

Backup and disaster recovery

Our primary database is backed up automatically every day at 03:00 UTC. Every backup includes the files held in our application database, including applicant CVs and resumes submitted through job applications. Backups are encrypted, retained for seven days, and cover all customer data in the deployment, giving a recovery point objective of 24 hours. Deployment configuration, environment variables, and pending scheduled functions are not part of database backups and are maintained separately. Semantic search indexes and analytics are derived from the primary database and are rebuilt rather than restored. Public assets in Cloudflare R2 are stored independently of the database backup cycle.

Restores are carried out by our team from any retained backup, into either the affected deployment or a separate deployment for verification before cutover. Restore time depends on the volume of data involved. Because a restore replaces a deployment's data as a whole, recovering a single record or a small set of records is handled case by case rather than through a full restore.

Encryption

In transit

All data transmitted between your browser and Cavuno is encrypted using TLS 1.2 or higher. This applies to all pages, API endpoints, and webhook callbacks. Outbound webhooks Cavuno sends are HTTPS-only; plain-HTTP destinations are rejected. We enforce HTTPS across all connections — HTTP requests are automatically redirected.

At rest

All data stored in our database is encrypted at rest using AES-256. This includes job listings, company profiles, account information, and any other data you store on the platform. Database backups are also encrypted.

Authentication

User authentication is handled through our application auth stack with Convex-backed session data. Passwords are never stored in plain text, and we support multi-factor authentication (MFA) for additional account security.

Session tokens are securely managed using HTTP-only cookies with appropriate SameSite and Secure flags. CSRF protection is enforced on all form submissions.

Multi-tenant data isolation

Cavuno is a multi-tenant platform, meaning multiple customers share the same infrastructure. We enforce strict logical data isolation through authorization checks built into every Convex query, mutation, and action.

Every database operation runs through an authenticated server function that verifies the caller's account membership and permissions before reading or writing data. This ensures queries can only access data belonging to the authenticated account, providing protection against data leakage between tenants.

Payment security

All payment processing is handled by Stripe. Credit card numbers, CVVs, and other sensitive payment data are submitted directly to Stripe and never touch our servers. Stripe is a PCI DSS Level 1 certified service provider — the highest level of certification in the payments industry.

Development practices

• The codebase is written in TypeScript with strict type checking enabled
• Development and production environments are separated
• Server-side input validation using schema validation on all API endpoints and server actions
• AI-assisted code review on pull requests to identify bugs, security concerns, and performance issues
• Signature verification on all incoming third-party webhooks (e.g. Stripe), and Standard Webhooks signing on every outbound delivery Cavuno sends to a customer endpoint
• File upload validation including MIME type checking and file size limits
• Automated dependency vulnerability scanning using Snyk, with alerts for known CVEs in production dependencies

Logging and monitoring

Application and infrastructure logs are retained by our managed providers according to their service policies. Security-relevant events are monitored and reviewed as part of our incident response process.

Security headers

We set security headers on all responses, including Strict-Transport-Security (HSTS) with includeSubDomains, X-Content-Type-Options, and X-Frame-Options.

Access control

Access to production systems is restricted to authorized personnel and governed by the principle of least privilege. SSO and MFA are used when available.

Responsible disclosure

If you believe you have discovered a vulnerability within Cavuno's application, please submit a report to us by emailing hi@cavuno.com. Cavuno does not participate in a bug bounty program at this time, nor do we provide monetary rewards for findings.

We ask that you give us reasonable time to investigate and address the issue before disclosing it publicly. We will acknowledge receipt of your report within 2 business days and aim to provide an initial assessment within 5 business days.

Incident response

In the event of a security incident, we follow a structured incident response process that includes containment, investigation, remediation, and notification. In accordance with Australia's Notifiable Data Breaches scheme, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) if a breach is likely to result in serious harm.

Subprocessors

For a complete list of third-party subprocessors that may process data on our behalf, see our Subprocessors page.

What we don't do (yet)

We believe in being upfront about the boundaries of our security program. As a small team, there are areas we haven't addressed yet:

• We have not completed an independent SOC 2 Type II audit of our own organisation. Our infrastructure providers maintain their own security and compliance programs, but we have not pursued our own certification.
• We have not commissioned an external penetration test. We rely on automated vulnerability scanning (Snyk), AI-assisted code review, and internal security assessments.
• We do not operate a bug bounty program or offer monetary rewards for vulnerability reports at this time.

We are actively evaluating these areas and will update this page as our security program matures.

Questions

If you have questions about our security practices or would like to request additional information, please contact us at hi@cavuno.com.