Security
Your career data, kept private.
Resumes hold your contact details, work history and job-search plans. Here’s how Resumr protects them, and what you control.
- Private by default.
- Encrypted in transit with HTTPS.
- Sign in with a password or a passkey.
The short version.
Strong sign-in
Sign in with email and password, Continue with Google, or a passkey. Passkeys use Face ID, Touch ID or Windows Hello, so there’s no password to steal. Apple, Microsoft, and GitHub sign-in are not offered yet.Private by default
Every document belongs to your account alone. Database rules check ownership on every request, so one account can never read another’s documents.You decide what’s shared
Nothing is public until you share it. Share links and profile visibility are yours to control, and you can change them at any time.
Account protection
Several layers keep your account yours.
- Passwords are handled by our authentication provider and are never stored in plain text.
- Add or remove passkeys at any time in Settings, under Passkeys.
- Sessions use secure cookies that refresh automatically, and signing out ends the session on that device.
- Private app pages confirm you’re signed in on the server before anything loads.
Data protection
Your documents are protected in transit and at rest.
- Every connection between your browser and Resumr is encrypted with HTTPS.
- Our database provider encrypts stored data at rest.
- Row-level security limits every database query to the signed-in account.
- Resume import reads your file in your browser, so the original file isn’t uploaded to extract its text.
Your controls
You can see, move and remove your data yourself.
- Download everything you’ve created as a zip file from Settings, under Export.
- Move documents to Trash, restore them, or delete them permanently.
- Delete your account and its data from Settings.
- Change a share link’s access or your profile’s visibility whenever you like.
Reporting a vulnerability
If you find a security issue, please tell us privately first.
- Email security@indr.app, or choose “Security issue” on the Contact page. The same address is listed at /.well-known/security.txt.
- Include the affected page, the steps to reproduce it and the impact you observed.
- Don’t access other people’s data or disrupt the service while testing.
- We’ll confirm we received your report and keep you updated while we fix it.
Build privately. Share when you’re ready.
Your drafts stay private until you decide to share them.