Security

The website and BuildR are hosted on Microsoft Azure, in data centres operated by Microsoft with their own physical and environmental security. Data stored in our Azure services is encrypted at rest by the platform.

All traffic to hyerhub.ai uses HTTPS. Requests over plain HTTP are redirected to HTTPS, and the site sends a Strict-Transport-Security header, so browsers refuse unencrypted connections to it and its subdomains. The emails our forms generate are handed to Azure Communication Services over HTTPS.

Every read in BuildR is scoped to the signed-in account. That separation is enforced in the database itself, not just in the interface, and automated tests verify it on every code change.

• Every change passes automated linting, content checks and a full production build before it can be deployed.
• Deployment credentials, API keys and connection strings are held in secret stores, never in source code.
• Form input is validated on the server and escaped before it is placed in any email.
• File uploads are limited by type and size: CVs sent with job applications must be PDF or Word files of up to 4 MB, and BuildR uploads are limited to 10 MB.
• Analytics runs only after consent, and the site embeds no third-party advertising or social media trackers.

BuildR suggests changes and you decide what goes into your resume. Our hiring products, TalentOS and Assess, are not yet available. They are being designed so that offers, rejections and other decisions affecting a candidate are routed to a human reviewer, not taken automatically.

If we become aware of a breach affecting personal data, we will contain it, investigate it, and notify the people affected and the Data Protection Board of India as the DPDP Act requires.

If you believe you have found a security vulnerability, email info@hyerhub.ai with "Security" in the subject line. Include enough detail for us to reproduce it. We will acknowledge your report and keep you updated while we fix it.

Please give us reasonable time to fix the issue before you disclose it publicly. Do not access, change or keep other people's data, and do not degrade the service for others. We will not pursue legal action against good-faith research that follows these rules.