Security
A career journal is personal by definition. Here's how we treat it.
This website
- Every marketing page is prerendered at build time. Only the signed-in app and the auth callback run server code, which keeps the attack surface small and easy to reason about.
- Strict security headers on every response: a Content-Security-Policy that allows no third-party scripts,
frame-ancestors 'none', HSTS, and nosniff. - Fonts are self-hosted. The marketing site makes no third-party requests.
- Your account record is an email address and nothing else. There is no password to leak, because sign-in is by emailed link or Google. Abuse protection uses a salted hash of the request IP, so raw addresses are never persisted and the rate-limit ledger cannot be traced back to a person.
The product (beta)
- Every table is protected by row-level security, default-deny: your rows are readable and writable by your authenticated account only, enforced in the database rather than in application code. We deliberately use no ORM, because an ORM would connect with privileges that bypass those rules.
- Journal data is encrypted at rest and in transit.
- AI calls run server-side; model API keys never reach your device. Your journal is never used to train models — ours or anyone's.
- Tailoring can only rephrase facts already in your journal. Every generated line carries the entry it came from, and output that cannot cite a real entry is rejected before you ever see it.
- Payments are handled by Stripe. Card numbers never touch our systems.
Reporting a vulnerability
Found something? Email hello@flexmywork.com with “SECURITY” in the subject. We'll acknowledge within 48 hours, keep you updated, and credit you if you'd like. Please give us reasonable time to fix before public disclosure.