Security and Trust

RaetOS stores sensitive career information: work history, resumes, captured job postings, generated application packets, and tracker records. Security decisions are designed around protecting that account-owned data and keeping access scoped to the right user.

This page explains account protections, data handling, and steps you can take if something looks wrong. The Privacy Policy explains collection, service providers, retention, and your data choices.

• Passwords are hashed with Argon2 before storage. Plaintext passwords are not stored.
• Two-factor authentication uses an authenticator app. Enable it in Settings; additional requirements apply to privileged access.
• Recovery codes are shown once, stored as hashes, and can each be used once. Save them somewhere safe before finishing setup.
• A trusted browser can skip the second-factor prompt for up to 30 days. Trust does not remove the password or provider sign-in requirement; avoid trusting shared devices.
• Session cookies use HttpOnly protection. Secure cookies and SameSite settings protect deployed browser sessions; cookie-authenticated writes also use CSRF checks.
• Cloudflare Turnstile and request limits help reduce automated abuse. Public Contact checks its verification token on the server before sending a message.
• Google and Microsoft sign-in use identity scopes only. RaetOS does not receive your Google or Microsoft password.

• Settings → Security shows active sessions and recent account security activity. Device labels and locations are indicators, not proof of who used a device.
• Sign Out Other Sessions ends other account sessions. Revoke ends extension access; Forget trusted devices removes browsers that skip the two-factor prompt.
• Access tokens are short-lived. Refresh tokens are stored as hashes, rotated during renewal, and checked for revocation.
• Inactive sessions end after seven days for ordinary accounts, with a shorter 12-hour window for privileged accounts. Background polling does not count as user activity.
• Remember me keeps the browser session across browser restarts. Session expiry, revocation and inactivity checks still apply.

• Application API requests require an authenticated user before protected account data is returned.
• Protected career records use account-scoped API access and database row-level security. Serving database connections use a role that cannot bypass row-level security.
• Server-side validation is used before account, profile, queue, packet, resume, tracker, and settings data is saved.
• RaetOS uses PostgreSQL-backed storage for account and career records.
• Authorized platform operations can involve account metadata, support tickets, and security records. Do not put passwords, recovery codes, or unnecessary sensitive information in a ticket.
• Security and administrative events are recorded for investigation. These records can have different retention from career records; account deletion does not instantly erase every log or backup.

Career records, resumes, packets, and support attachments are stored in PostgreSQL hosted by Neon. Neon states that stored data is encrypted using AES-256. This is provider-managed encryption; see Neon's security statement.

• Avatar uploads use AWS S3 server-side encryption. S3 encryption does not describe how database records are protected.
• Account email addresses and authenticator secrets have additional application-level encryption. This does not mean every career field is encrypted separately.
• HTTPS protects browser connections in transit. Storage encryption does not prevent authorized processing of your data inside the service or by providers involved in a feature.

The RaetOS extension is designed to send job-posting details to My Queue when you choose to capture a posting.

• The extension runs content scripts across browsing pages to detect supported job postings and display capture controls. Manage its site permissions through your browser.
• Capture sends the selected posting to My Queue. The extension also checks whether a detected job has already been captured or applied to.
• Google and Microsoft sign-in do not grant mailbox access. Browser extension page permissions are separate from sign-in identity permissions.
• Extension access can be disconnected by signing out of the extension or revoking extension sessions from Settings.
• Local sent-board counters can be cleared without deleting queue items already saved to the RaetOS account.

RaetOS uses AI for product features such as job-posting analysis, resume generation, application packets, interview preparation, cover letters, message composition, and career-record enrichment.

• Requests can include relevant resume evidence, job descriptions, selected contact details, notes, and context you provide.
• AI-generated outputs are drafts and should be reviewed before use.
• OpenRouter routes requests to model providers; direct OpenAI requests can be used as a fallback. Provider retention and training policies depend on the route and account configuration.
• There is no universal zero-retention promise across AI routes. Avoid including employer secrets or other information you are not allowed to share.

See the Privacy Policy's AI section for provider policies and processing details.

• Use a unique password and enable two-factor authentication. Secure the email or identity-provider account you use to sign in.
• Keep recovery codes offline or in a secure password manager. Never email your password, authenticator secret, or recovery codes, including in a support request.
• On a shared device, leave Remember me and browser trust off, then sign out when finished.
• If you see unfamiliar activity, reset your password or secure your sign-in provider, sign out other sessions, revoke extension access, and forget trusted devices. Contact Security if you still suspect compromise.
• Use Settings to export supported records or request account deletion. Read Privacy for retained security records, provider backups, and delivered messages.

No internet service can guarantee perfect security. Testing individual controls does not establish that every deployment, provider, or workflow is free of vulnerabilities.

• RaetOS does not claim a SOC 2 attestation, ISO 27001 certification, or FedRAMP or StateRAMP authorization. A provider's credentials do not certify RaetOS.
• Two-factor authentication currently uses authenticator codes and recovery codes; passkeys and hardware security keys are not offered.
• Uploaded support attachments are not malware-scanned. Open only files you trust and keep your device protection current.
• Use the Security contact below for questions or requests for available evidence. This page is not an independent security assessment.

If RaetOS confirms a security incident affecting personal data, we will investigate, take steps to contain the issue, and notify affected users or regulators when required by applicable law.

To report a suspected vulnerability, include the affected page or feature, approximate time, steps to reproduce, and expected versus observed behavior. Use your own account and redact personal data from screenshots. Do not access another person's records or send secrets. Contact us before sharing exploit details publicly.

For security questions or vulnerability reports, contact [email protected].

For privacy or data requests, contact [email protected].

Related pages: Privacy Policy, Terms of Service, and Cookie Policy.