Security

All traffic to and from Xotter is encrypted with TLS. Customer data stored in our database is encrypted at rest with AES-256 by our infrastructure provider, Supabase. Passwords are stored as bcrypt hashes with per-user salts; we never store plaintext passwords.

Xotter is hosted on the Lovable platform, and application data is stored by Supabase in the AWS US West (Oregon) region. Customer data is processed in the United States.

We use PostgreSQL Row Level Security policies to enforce per-row authorization at the database layer, so authenticated users can only access data their account is permitted to access. This operates as defense in depth alongside our application authorization.

Resume content and job descriptions you submit are transmitted to Anthropic over an encrypted connection for AI-powered tailoring. Anthropic does not use commercial API content to train its foundation models and deletes content from its backend within 30 days, with limited exceptions described in our Privacy Policy.

Supabase is SOC 2 Type 2 compliant and ISO/IEC 27001:2022 certified. Anthropic is SOC 2 Type II, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certified. Lovable is SOC 2 Type II and ISO/IEC 27001:2022 certified. Xotter itself has not undergone independent security certification.

Email jay.cadmus@innovixdynamix.com.