Your data is yours.
A job search involves the most sensitive professional information you hold. We treat it accordingly — encrypted, isolated, never sold, and fully exportable.
Encryption at rest and in transit
All data is encrypted using AES-256 at rest, and all connections use TLS 1.3. Your CV, Extended CV, and Biography Statement are held in private storage that is never publicly accessible, with access to every record and file enforced per-account by the database itself — see row-level security below.
Row-level security
Supabase Row-Level Security (RLS) policies mean the database itself enforces that each subscriber can only access their own data. No backend code path can accidentally expose one subscriber's records to another.
Document storage isolation
Generated CVs and cover letters are stored in private Supabase Storage buckets. Access requires a signed URL bound to your session — documents are never publicly accessible, indexed, or shared.
AI processing: no training on your data
Your profile data is processed by Anthropic (the Claude API) for matching and document generation. Anthropic's enterprise terms explicitly prohibit using customer data for model training. Your career information is not shared with any third party beyond what is disclosed in our privacy policy.
We never auto-apply on your behalf
MeridianRoles does not submit applications, contact employers, or interact with any ATS on your behalf. The scout finds and ranks. Every application decision is yours — this is a deliberate design commitment, not a roadmap item.
Stripe for payments — no card data on our servers
All payment processing is handled by Stripe. MeridianRoles stores only your Stripe customer ID and subscription status. No card numbers, CVCs, or billing information are ever transmitted to or stored on our infrastructure.
Full data rights, fully honoured.
MeridianRoles is designed for GDPR compliance from the ground up. The following rights are available to all subscribers without needing to contact us for most of them.
Personal data is processed by: Supabase (database, auth, file storage — United States, US East region), Anthropic (AI scoring and document generation — no training rights), Stripe (payments — PCI DSS Level 1), Resend (email delivery), and Twilio (SMS). A full list of sub-processors is in our privacy policy.