Last updated: July 2026

Security

Your CV and career information are sensitive. Here's a plain-language summary of how Tarshih protects them. This page is informational and doesn't limit or expand the commitments in our Privacy Policy.

Encryption

Data is encrypted in transit between your browser and our servers using HTTPS/TLS, and encrypted at rest in our database and file storage.

Authentication

Account authentication is handled by our authentication provider, which stores passwords using industry-standard hashing rather than plain text. You can also sign in with Google OAuth, in which case we never see or store your Google password.

Access controls

Access to production data is restricted and limited to what is necessary to operate and support the Service. We do not grant broad standing access to user content.

Payment security

Card payments are handled entirely by our third-party payment provider, over its own secure, PCI-compliant checkout. Tarshih never receives or stores your full card number, expiry date, or CVV on its own servers.

Third-party AI processing

When your CV or a job description is tailored, relevant content is sent to third-party AI providers (currently OpenAI and Google Gemini) over encrypted connections solely to generate your requested output. This is described in more detail in our Privacy Policy.

Data isolation

Your resumes, cover letters, and history are scoped to your account and are not visible to other users.

Reporting a security issue

If you believe you've found a security vulnerability in Tarshih, please report it to support@tarshih.com with as much detail as possible. Please do not publicly disclose a suspected vulnerability before giving us a reasonable opportunity to address it. We appreciate responsible disclosure and will respond as quickly as we can.