The résumé is yours. We act like it.
Encrypted at rest and in transit, locked behind hardware-key MFA, and audited yearly by an external firm. Here's the receipts.
The practices, in plain English.
Encryption everywhere.
Everything you type into BeauCV is encrypted with AES-256 at rest in our databases and TLS 1.3 in transit. Our database backups are also encrypted with separate keys, rotated quarterly.
Access by hardware key.
No password alone gets near production. Every BeauCV engineer authenticates with a hardware security key. Access is gated by role, logged, and reviewed monthly.
Your résumé doesn't train external systems.
Your text is sent to a rewrite provider with a zero-retention configuration: deleted within 30 days, never used for training.
Data residency you choose.
At signup, you pick the region your data lives in: eu-west-1 (Ireland) or us-east-1 (Virginia). It never leaves.
Recover from anything.
Real disaster recovery drills, every quarter. We restore a full production database into a staging region, then run the test suite end-to-end. Our last RTO measurement was 38 minutes.
Delete means delete.
When you delete a résumé or your account, it's gone from active databases immediately and from every backup within 30 days. We keep only the bare minimum required for tax records.
Every vendor that touches your data, listed.
We give 30 days' notice before adding any new sub-processor. You may object before it takes effect.
Find something? We pay.
Responsible disclosure to security@beaucv.fr. We respond within 48 hours and publish researcher credit (with permission) in our security log.
Report a vulnerability.
Send a detailed report to security@beaucv.fr. PGP encryption available. We acknowledge within 24h, triage within 48h, and pay within 14 days of validation.