# How your resume and data are protected

> How Zorlya protects your resume and data, who else handles it, and how to report a security problem.

Source: https://zorlya.com/security

A resume is personal data. This page says what happens to it, who else touches it, and how to report a problem.

## Sign-in

Passwords are hashed with bcrypt. Sessions use httpOnly cookies: an access token that lasts 15 minutes and a refresh token that is replaced on every use. Sign-in is limited to 10 attempts a minute per address.

## Accounts

An account sees nothing until it is invited or approved. Every product route checks that status.

## Storage

Resumes and their embeddings are stored in Cloudflare D1, and so are the job vectors: matching reads them from D1. The API is a Cloudflare Worker that reaches them through Cloudflare bindings. Every connection from your browser to the API is encrypted with TLS. Support tickets are in D1 too. Resume files, profile pictures, mailbox pictures and ticket attachments are files in private Cloudflare R2 buckets in the European Union.

Company mail is stored in a private Cloudflare R2 bucket with no public address, in the European Union: the whole message and its attachments. Files that Zorlya keeps in R2, and copies of database backups kept there, are stored in the European Union too. The database is a separate matter: this page does not claim where Cloudflare D1 keeps its data. A message's headers, text and search index are in D1. A message is shown to staff in a sandboxed frame that loads nothing from the network, and an attachment is downloaded, never run, and each download is logged. Trash and Spam are emptied after 30 days. The [privacy policy](https://zorlya.com/privacy#mail) has the full retention list.

The apps and this site can be installed and opened offline. The service worker stores only the app's own files, never an API response or anything about you, and the apps clear it when you sign out.

## AI providers

Resume passages reach a model only to score, explain or draft. That is Cloudflare Workers AI, in the same account that hosts Zorlya, and no other provider receives it today. Cloudflare does not train its models on these requests. If we add a provider, this page is updated before any of your data goes to it.

## Connected clients

Only the AI apps on Zorlya's list (Claude, ChatGPT, Claude Code and Cursor) can connect (we have not tried the ChatGPT connection ourselves), and only through the return addresses their publishers use. They sign in with OAuth 2.1 and PKCE, on a Connect page where you choose the account and the permission level (read only by default). Changing data asks for your password again. Their tokens work only on the MCP server's address, are stored only as SHA-256 digests, last an hour, and stop working the moment you revoke the app. No tool hard-deletes anything, and staff accounts get read-only tools. Requests an AI app makes are logged with their contents and kept for 90 days, and the rest of the record, including the IP address and user agent, is kept for 13 months. A request that changes data is refused if the log's queue does not confirm it. The arguments of a tool call are stored as sent, so a secret typed into one would be stored. These AI apps are run by their publishers, not by Zorlya, and what an app does with what it reads is the publisher's policy. The [privacy policy](https://zorlya.com/privacy#ai-requests) has the detail.

## Deletion

Delete files, letters and applications yourself at any time. Ask us and the whole account goes within 30 days, in one operation that takes everything attached to it.

## Sub-processors

| Service | Purpose | Data it receives | Location |
| --- | --- | --- | --- |
| Cloudflare | Hosting the site, apps and API; the database (D1), which also holds the job vectors; rate limits; the default AI models (Workers AI); account email and company mail sending (Email Sending); receiving company mail (Email Routing and an Email Worker); storing company mail (R2); keeping the log of AI app requests (Queues, database and R2); looking up a sender's brand logo record (DNS over HTTPS); the bot check on the pricing page Buy buttons (Turnstile); cookieless page view and load time statistics for zorlya.com (Web Analytics); Worker logs | Requests and IP addresses; browser details for the bot check; resume passages and job text for AI requests; email address, name and message for account email; the full text and attachments of mail sent to our addresses, and of our replies; the contents of the requests AI apps make for you, with your IP address and user agent; the domain of a sender, for the logo lookup | Global network; R2 storage (mail, files and backup copies) in the European Union |
| Freemius | Taking payment for paid plans as the seller of record, tax, receipts, refunds, and the customer portal | Name, email address, billing details and payment details, entered on its checkout. Zorlya sees the plan and its status, never the card | United States |
| Gravatar | Your profile picture, if you have one there; the picture of a person who writes to us, in the mail app | A hash of your email address, from your browser; a SHA-256 hash of a sender's address, and our server's IP address, from our server | United States |
| Google (Gmail) | An inbox we own, which receives a copy of some mail sent to our addresses, and of a message we could not save | The mail forwarded to it | Not stated |
| Google (Analytics) | Counting visits to zorlya.com, the public site only, after the visitor accepts the cookie banner. A cookieless ping is sent before that. Not used in the apps or the API | Page address, referrer, browser and device, and the IP address; with consent, the `_ga` cookies and an approximate location | Not stated |
| Slack, Discord | Only if you add a webhook for alerts | The alert text | United States |

Last reviewed 24 October 2026. Changes are announced in the [changelog](https://zorlya.com/changelog). Support tickets are not sent to any other service. Other model providers, such as OpenAI and Anthropic, are not used today and are added to this table before they receive any data.

## Found a problem? Tell us first

Send the details to security@zorlya.com. You get a reply within two working days. Please do not test against other people's accounts or publish before a fix ships.

Report a vulnerability [Other questions](https://zorlya.com/contact)

Related: [Privacy policy](https://zorlya.com/privacy), [Terms of service](https://zorlya.com/terms), [System status](https://zorlya.com/status), [OAuth and MCP details](https://zorlya.com/developers#oauth).

Questions?

## Write to us.

A person reads every message and answers in plain words.

[Contact us](https://zorlya.com/contact)