Security

Version 1.0 · Last updated: 4 August 2026

Hike holds resumes, work histories and job applications. This page describes how we protect them.

Every statement here was verified in the code before it was written. We have deliberately left out anything we could not verify, and we do not claim any certification we do not hold.

Passwords are hashed with bcrypt. We never store a password in a form anyone, including us, can read.

Password reset codes, email verification codes and download tickets are stored only as SHA-256 hashes, so reading our database does not produce anything usable. Reset and verification codes expire after 15 minutes and are burned after five wrong attempts.

Sign in tokens are short lived: 15 minutes for the access token, 7 days for the refresh token, and refresh tokens are single use and rotate.

Signing out takes effect immediately. Every account carries a version number that is checked on every request, so signing out, changing your password or changing your email address invalidates existing sessions at once rather than waiting for a token to expire.

You can see every device signed in to your account, with its browser, operating system and approximate location, and sign any of them out. Changing your password signs out every other session.

If you sign in with Google or LinkedIn, we request only your name, email address and profile picture. We do not request access to your mail, calendar, files or connections.

2. In transit and at rest

All traffic uses HTTPS. We send HTTP Strict Transport Security headers, so browsers refuse to connect to us insecurely after their first visit.

Your data is stored on Amazon Web Services infrastructure in their Montreal region. We are not making a specific claim about encryption at rest on this page, because we would only state it after verifying the exact configuration, and we have not done that yet. When we have, it will appear here.

3. What we do not collect

The strongest security control is not holding something in the first place.

No analytics, no advertising pixels, no session replay, no crash reporting, no third party trackers, on the website, in the app, in the browser extension or in the mobile app.
Your IP address is not written to our application logs. Request logs contain a method, a path and a request ID, and nothing else.
Request bodies are never logged, so your resume text does not appear in our logs.
The browser extension's LinkedIn profile review runs entirely on your device and its result is never sent to us.

4. Abuse and integrity

We rate limit by IP address across the API, with tighter limits on sign in, AI generation, data export and invitations.

When you paste a job link for us to read, the request is checked against a guard that blocks internal and private network addresses, and each redirect is re-checked, so the feature cannot be used to make our server reach somewhere it should not. Responses are size capped and time limited.

Content pasted into job descriptions is sanitised against an allowlist before it is stored.

5. Your data, on your terms

Export. Settings → Account and security → Your data produces a complete machine readable file, generated live from the database rather than from a separate list that could drift out of date. An automated test walks the whole output on every build to confirm no credential or hash can appear in it.

Deletion. Deleting your account signs you out everywhere immediately and marks the account deleted. After 30 days, an automated job permanently erases the account record, everything linked to it, and every file you uploaded.

6. Where we are honest about limits

We are a small team and a young product. We do not hold SOC 2, ISO 27001 or any other security certification, and we will not imply otherwise. We have not commissioned a third party penetration test.

Database backups are held on a rolling schedule by our hosting provider. We have not yet published the exact retention window, and we will not quote one until we have confirmed it.

7. Reporting a vulnerability

If you find a security problem, please tell us before you tell anyone else.

Email tech@pintarlabs.io with enough detail to reproduce it. We will acknowledge within three working days and keep you updated until it is resolved.

We will not take legal action against anyone who:

reports in good faith and gives us reasonable time to fix the issue;
avoids privacy violations, service degradation and data destruction;
accesses only their own accounts and data, never anyone else's.

We do not currently run a paid bug bounty. We will credit you if you would like us to.