Security model.

The Candidature is a small product in private beta, and security is treated as a first-order design constraint, not a checklist. This page describes how the product handles your data, where the trust boundaries are, and how to report a concern.

How your data is stored

Account access, waitlist records, profile details, resume material, and onboarding state are stored through Supabase services. Access is tied to your authenticated account. The product is built so application preparation can happen without recruiter marketplaces, resale incentives, or public posting of your materials.

The application workflow keeps review gates in front of submission. A prepared form, draft, or attachment is not meant to be submitted until you approve it.

How the web app talks to your data

The browser uses authenticated Supabase sessions and product API calls. Protected routes require a signed-in user, and account setup is gated through onboarding before the app can prepare live search material.

Uploads and generated materials are scoped to the account they belong to. We keep the public landing and waitlist flow separate from the authenticated app so visitors do not download dashboard and workflow code before they need it.

Authentication

Account access is gated by Supabase Authentication. We do not store passwords in plaintext. We rely on Supabase's identity tokens and JWT-based sessions, with the same hardening applied to its hosted Postgres platform. Sessions can be revoked from your account at any time.

Network and transport

All traffic to The Candidature servers is encrypted in transit. The sign-up endpoint, the analytics endpoint, and the authenticated session endpoint all require HTTPS. We do not accept unencrypted traffic.

Vendors in the trust path

• Supabase · authentication, database, and file storage. Operated by Supabase.
• Google Analytics · aggregate landing-page traffic only. Does not see authenticated state.

The team reviews vendor changes when they happen and will write to active users if a change affects the trust path.

What is, and is not, on our servers

On our servers · your waitlist email, account session, onboarding profile, uploaded resume material, product records needed to run your search, and aggregate landing-page analytics.

Not sold from our servers · your resume material, your target companies, your drafted application content, or behavioral profiles for ad targeting.

Reporting a security concern

If you find a vulnerability or a behavior that contradicts what this page describes, write to james@thecandidature.com with the subject line Security. Please include enough detail to reproduce the issue.

We acknowledge security reports within two business days, work toward a fix in good faith, and credit reporters who would like the credit. We do not threaten legal action against researchers acting in good faith.