Your data is yours.
A job search involves the most sensitive professional information you hold, and we treat it that way. It is encrypted, kept apart from other accounts and never sold, and you can export all of it.
Encryption at rest and in transit
All data is encrypted with AES-256 when stored, and all connections use TLS 1.3. Your CV, Extended CV and Biography Statement are held in private storage that is never open to the public. Each account can reach only its own records and files (see row-level security below).
Row-level security
Supabase Row-Level Security (RLS) means the database itself limits any request made with your sign-in to your own data. Many server tasks use a protected admin connection that is not limited this way. They include scouting, billing, data export, saving your settings and making your documents.
Document storage isolation
Your tailored CVs and cover letters are stored in a private Supabase Storage bucket. You can open one only while signed in, and only if it is yours. Documents are never public, never indexed by search engines and never shared.
Data processing: no training on your data
Anthropic (the Claude API) processes your profile data for matching and to create your documents. Anthropic's enterprise terms explicitly forbid using customer data to train models. We do not share your career information with anyone else, except as our privacy policy sets out.
We never auto-apply on your behalf
MeridianRoles does not submit applications, contact employers or act in your name on any applicant tracking system. The scout finds and ranks roles. Every decision to apply is yours. This is a deliberate decision, and we do not plan to change it.
Stripe for payments · no card data on our servers
Stripe handles all payments. MeridianRoles stores only your Stripe customer ID and subscription status. Card numbers, security codes and billing details are never sent to or stored on our systems.
Full data rights, fully honored.
We built MeridianRoles to comply with GDPR from the start. Every subscriber has the rights below, and you can use most of them without contacting us.
Personal data is processed by: Supabase (database, auth, file storage; United States, US East region), Anthropic (AI scoring and document generation; no training rights), Stripe (payments; PCI DSS Level 1), Resend (email delivery), and Twilio (SMS). A full list of sub-processors is in our privacy policy.