How Trajectry protects your data

1. Overview

Trajectry is built with security as a foundational concern, not an afterthought. We apply defense-in-depth principles across every layer of the platform to protect your data and privacy. Here is the short version:

• Encryption everywhere: TLS 1.2+ in transit, AES-256 at rest
• No advertising or marketing trackers on the platform
• Voice recording requires your explicit consent before every session
• AI providers do not train on your data
• 24-hour acknowledgment target for security reports
• GDPR and CCPA compliance built in from day one

2. Infrastructure Security

Trajectry runs on managed cloud infrastructure from established providers. Our database and authentication layer is hosted on Supabase (built on AWS), the frontend is served through Vercel, and AI processing runs on Google Cloud.

We do not operate self-managed servers. By leveraging managed services, we inherit the security controls, certifications, and operational practices of industry-leading cloud providers, including network isolation, physical security, and continuous monitoring.

3. Data Security

All data transmitted between your browser and our servers is encrypted with TLS 1.2 or higher. Data stored in our database is encrypted at rest using AES-256 encryption provided by Supabase on AWS infrastructure.

Database backups are encrypted. Credentials, API keys, and secrets are never stored in plaintext and are managed exclusively through environment variables with access restricted to production systems.

4. Authentication and Access Control

User authentication is handled by Supabase Auth with JWT-based session management. Access controls are enforced at multiple levels:

• JWT tokens verified using JWKS with RS256 signatures
• Role-based access control separating user and admin privileges
• Subscription-level gating for premium features
• Global rate limiting at 200 requests per minute with additional per-route limits
• Automatic session expiration and token refresh

5. AI and Data Processing

Trajectry uses Google Gemini to process conversations, parse resumes, and generate career recommendations. We practice data minimization: only the information necessary to fulfill your specific request is sent to the AI provider.

Your data is not used to train AI models. Google Gemini processes data to generate a response and does not retain it for model improvement. All AI-generated content is presented with clear disclaimers indicating that output should be reviewed before use.

6. Application Security

We follow secure development practices throughout the application lifecycle:

• Input validation using Pydantic models on all API endpoints to prevent injection attacks
• Request size limits (1 MB maximum) to mitigate abuse
• Security headers enforced: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options
• Dependencies regularly updated and monitored for known vulnerabilities
• Code review required for all changes before deployment
• No user-supplied content is rendered as raw HTML

7. Voice Security

Voice onboarding sessions are powered by LiveKit using encrypted WebRTC connections. Recording and transcription require your explicit consent before every session begins. You can withdraw consent at any time.

Voice transcripts are stored separately from your main profile data and are automatically deleted after 90 days. Raw audio is not retained after transcription is complete.

8. Email and Outreach Security

All outreach emails are sent through Resend with the following safeguards:

• Suppression list enforcement to respect unsubscribe requests and prevent contacting bounced addresses
• Rate limiting on outreach to prevent abuse and protect sender reputation
• Company blacklist checks before any outreach is sent
• No unsolicited email is sent without user initiation
• Full audit trail maintained in the outreach log for transparency

9. Incident Response

We monitor for security events using Sentry for error tracking and PostHog for anomaly detection. Our incident response process targets a 24-hour acknowledgment window for all security reports.

In the event of a confirmed data breach, affected users will be notified promptly with details about the scope, impact, and remediation steps. We conduct post-incident reviews to identify root causes and implement preventive measures.

10. Vulnerability Disclosure

We welcome responsible security research. If you discover a vulnerability in Trajectry, please report it through the support channel listed in your account settings or contact us at the email provided in your deployment communication.

We target a 24-hour acknowledgment for all security reports and will work with you to understand and address the issue. We do not pursue legal action against researchers who report vulnerabilities in good faith.

11. Compliance and Contact

Trajectry is designed to comply with GDPR and CCPA requirements. We offer in-app data export and deletion, consent management for optional processing, and clear documentation of our data practices. A Data Processing Agreement (DPA) is available on request for enterprise customers.

For security questions, vulnerability reports, or compliance inquiries, contact the Trajectry team through the support channel listed in your account settings or deployment communication.