Security at Meritque

Data protection

• All traffic is served over HTTPS with modern TLS.
• Data is encrypted at rest in our managed database and file storage.
• Every table that holds your content is protected by row-level rules, so records are readable only by the account that owns them.
• API keys and provider credentials are stored as server-side secrets, never exposed to the browser.

Account security

• Email and Google sign-in with managed, verified sessions.
• Passwords are hashed by our authentication provider and never visible to us.
• Sensitive actions run on the server, where the signed-in identity is verified on every request.
• Administrative roles are stored separately and checked server-side, not in the browser.

Payments

Subscriptions are processed by Stripe, a PCI-DSS Level 1 provider. Card details are entered on Stripe's hosted checkout and never touch our servers. We store only the subscription status needed to give you access.

AI and your content

When you ask Meritque to tailor a resume, write a cover letter, or draft outreach, only the parts of your profile relevant to that job are sent to the AI model provider. Your content is not used to train public models. Drafts stay in your account until you export or send them.

Nothing is sent without your approval

Autopilot prepares matches and drafts in the background, but it never submits an application or sends an email on its own. Everything waits in your review queue until you approve it.

Monitoring and reviews

• Automated database and dependency scans run against the project regularly.
• Server-side error monitoring flags failures so we can fix them quickly.
• Usage limits protect the platform against abuse and runaway automation.

Your control

You can export or delete your documents and profile at any time from the app, and request full account deletion by email. See our Privacy Policy for what we collect and how long we keep it.

Report a vulnerability

If you believe you have found a security issue, email meritcue@gmail.com with the details and steps to reproduce. Please give us a reasonable chance to fix it before public disclosure. We read every report and respond to legitimate ones.