Security
An overview of current controls. Not an audit report or certification.
ApplyPilot has not been audited or certified against any security or privacy standard. This page lists only controls that exist in the product today.
Local-first files
Resumes, cover letters, screenshots and application working files are created and kept in a workspace folder on your computer by the ApplyPilot Local Agent. They are not uploaded to the ApplyPilot cloud.
Credentials in the operating system keyring
Employer portal and email app passwords are stored by the Local Agent in your operating system's credential store (for example Windows Credential Manager), not in the cloud and not in a plain text file.
Browser encryption to your device key
Before the browser sends a credential or a verification code to your Local Agent, you confirm the agent's device fingerprint, shown in the ApplyPilot Agent window on your computer when it starts. The browser remembers that trusted device key locally (never in the cloud) and encrypts credentials and verification codes to it (ECDH P-256, HKDF-SHA256, AES-256-GCM) before they are relayed. If the key ApplyPilot returns ever differs from the one you confirmed, the browser stops and sends nothing. This check depends on the ApplyPilot web page itself being intact; it does not protect against a compromised web host. You can always enter credentials directly in the Local Agent instead, and if your browser cannot encrypt there is no fallback: you use the Local Agent.
Human-only verification
When an employer site shows a CAPTCHA, a one-time code, an MFA prompt, a passkey or a security key request, the Local Agent pauses and asks you to complete it yourself. For a code the employer sent you, you can type it in the dashboard: your browser encrypts it for your computer only and the Local Agent types it into the employer's page, or you can type it in the employer's own window yourself. Passkeys, security keys and phone approvals are always done by you on your computer. A CAPTCHA is done by you too, on your computer. ApplyPilot does not solve, skip, work around or automate these checks and does not use solving services.
Minimal cloud data
The cloud keeps your account, sessions, paired devices, preferences and status records. It does not receive CAPTCHA tokens or cookies, and it never sees employer passwords in readable form. A one-time code you type in the dashboard passes through only as an encrypted envelope that the cloud cannot read, and is kept only until it is used or expires.
Account protections
ApplyPilot account passwords are stored only as Argon2 hashes. Session cookies are HttpOnly, state-changing requests carry a CSRF token, sensitive actions such as data export ask you to re-enter your password, and authentication endpoints are rate limited.
Transport
In production, traffic between your browser, the cloud API and the Local Agent is carried over TLS (HTTPS and secure WebSockets).
Reporting a vulnerability
This contact address will be published here before launch.