1. Your account
- Passwords are stored only as salted hashes, never in plain text.
- Sessions use random tokens that are stored hashed. They expire after inactivity and after a fixed maximum, are renewed whenever you sign in or change your password, and you can sign out of every device from Settings.
- You can sign in with Google instead of a password.
2. Your data
- All traffic is encrypted with HTTPS.
- Files are encrypted at rest. Resume and video files are served through short-lived signed links, never public addresses.
- Access to production data is limited to named staff, and admin actions on an account are recorded.
- Your resume, profile and messages are used only to find and apply for jobs for you. Employer mail is never forwarded to an address you have not confirmed.
- You can hibernate or close your account at any time, and your personal data is removed as described in the Privacy Policy.
3. Payments
Card payments are taken by Stripe and naira payments by Paystack. We do not see or store your full card number. Credits for an application that fails on our side are returned automatically.
4. Applications sent for you
Break-In Bad submits only what you have approved or set to run on its own, and keeps a screenshot and confirmation of every submission so you can check exactly what was sent. You can pause or stop any role at any time.
5. Reporting a problem
If you find a security problem, write to security@breakinbad.ai with what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing. We read every report and tell you what we decide.
No system is perfectly secure. If we find a breach that affects you, we will tell you and the relevant authority without undue delay.