Trust & Security Architecture

Perfolio uses administrative, technical, and organizational safeguards designed to protect sensitive career records, rubric evaluations, drafts, and impact notes:

• Application-Layer Envelope Encryption. Configured sensitive fields are encrypted at the application layer using AES-256-GCM. Each user account is protected by an individual Data Encryption Key (DEK). These per-user DEKs are wrapped by Key Encryption Keys (KEKs) managed within Hardware Security Modules (HSMs) in Google Cloud Key Management Service (Cloud KMS).
• Database Isolation via Row-Level Security (RLS). PostgreSQL Row-Level Security policies on Supabase enforce strict tenant and user partitioning. Database queries execute in the context of the authenticated user, preventing cross-tenant data access at the engine level.
• Encryption in Transit & Web Hardening. All network traffic is encrypted using modern TLS (TLS 1.3). The web application enforces HTTP Strict Transport Security (HSTS with preloading), strict Content Security Policy (CSP) with cryptographic nonces, clickjacking defense (X-Frame-Options: DENY), and MIME-sniffing protection.
• Server-Side Decryption Boundary. Encryption is application-layer, not end-to-end or zero-knowledge: Perfolio decrypts authorized records on the server when needed to deliver requested features (such as generating promotion dossiers or formatting Friday updates). Operational metadata (record identifiers, timestamps, status flags, and provider keys) remains unencrypted where needed to operate the service.

A fundamental tenet of Perfolio is that a career record belongs to the individual professional, not their corporate employer:

• No Administrator Inspection. Even when an employer purchases enterprise team licenses, organization administrators and managers have zero technical capability to inspect an employee's private evidence items, unshared drafts, sponsor relationships, gap radar, or individual readiness scores through admin surfaces.
• Aggregate Telemetry Safeguards (≥5 Users). Where enterprise organizational reporting is enabled, leadership views only anonymized, cohort-level adoption and competency coverage distributions. Cohort thresholds strictly enforce a minimum of five users and suppress small groupings to prevent re-identification or differencing attacks.
• Explicit Sharing Sovereignty. Deliverables and promotion packets are visible to others only when the employee explicitly publishes a Friday update or exports a dossier.

Perfolio employs strict governance controls over all artificial intelligence processing:

• Zero Model Training Guarantee. Perfolio never trains, fine-tunes, or evaluates any foundation models on customer content. We process requests exclusively through the enterprise paid tier of the Google Gemini API, which contractually guarantees that customer prompts, inputs, and outputs are never used to train Google models.
• Scoped Search Grounding for Public Research Only. Google Search grounding is utilized strictly and exclusively for public web research—such as discovering public industry leveling expectations (e.g., standard Staff-level criteria) and upcoming public tech conferences or CFPs. Private customer records, pull request excerpts, and connector artifacts are never passed to grounded search.
• Enforced Human Review Gate. AI suggestions never commit fabricated or unverified claims into an engineer's official record. Ingested items land in a staging Review Inbox where the engineer reviews, edits, tags, or rejects every suggested deliverable before it is sealed.

Perfolio connects to workplace tools strictly through minimal, read-only OAuth 2.0 permissions:

• GitHub. Ingests only metadata: PR titles, descriptions, commit summaries, merged timestamps, and review approvals. Perfolio never requests write access, never clones repositories, and never stores full source code trees.
• Slack. Scoped strictly to public channel praise mentions and leadership project asks. Code-level enforcement (isPublicChannel()) strictly discards direct messages (DMs), group DMs, and private channels before processing. Zero chat history is stored.
• Google Workspace & Microsoft 365. Read-only ingestion of finished meeting metadata (organizer, attendee counts) and user-authored design specifications or RFCs. Never records audio or transcribes calls.
• Credential Protection. Connector OAuth tokens and credentials are encrypted using per-user DEKs and stored in server-only database tables inaccessible to client queries.

Perfolio partners with cloud infrastructure and service providers subject to strict data protection standards:

• Supabase: Database storage, authentication, and Row-Level Security.
• Google Cloud Platform: Hardware Security Modules (KMS) for key wrapping, and enterprise Gemini API for AI processing.
• Cloudflare: Global edge network delivery, DDoS protection, and secure tunneling.
• Stripe: Payment processing (Perfolio never stores credit card details).
• Resend: Transactional email delivery.
• Sentry: Error monitoring with PII and sensitive data scrubbing.

You maintain full sovereignty over your data at all times:

• Full Career Portability. Your account belongs to you, not your employer. You can export your complete career evidence graph and dossiers at any time in standardized Markdown, JSON, or CSV formats.
• Cryptographic Account Deletion. Deleting an account deletes live records and destroys the associated per-user encryption key (cryptographic erasure). Backup systems cycle according to standard operational recovery schedules; deleted data is not restored except where required for documented disaster recovery.

While standard self-serve accounts are governed by the public online terms, enterprise deployments receive dedicated contractual protections:

• Enterprise Agreements (MSA, DPA, SLA). Enterprise customer contracts supersede consumer website terms with customized liability provisions, mutual indemnification, data processing terms, and service-level commitments.
• Pooled Capacity & Admin Controls. Enterprise plans feature pooled organization capacity (eliminating individual AI-unit limits), custom connector allowlists, and centralized seat administration.
• Assurance Roadmap. Perfolio operates on cloud infrastructure maintained by certified providers (Supabase SOC 2 Type II, Google Cloud ISO 27001 / SOC 2). Independent third-party penetration testing and formal application-level attestations are prioritized on our product roadmap. Contact our team for architecture review packages under NDA.

We welcome reports from security researchers and the developer community. If you believe you have identified a vulnerability in Perfolio, please notify us responsibly:

• Primary Contact: Email [email protected] with a detailed reproduction path. Our RFC 9116 security file is hosted at /.well-known/security.txt.
• Safe Harbor: We consider good-faith security research conducted in accordance with this policy to be authorized. We will not pursue legal action against researchers who disclose issues responsibly, avoid accessing unauthorized customer data, avoid service degradation (DDoS), and give us reasonable time to remediate before public disclosure.
• Response Commitment: We acknowledge verified reports within two business days and provide ongoing updates as remediation proceeds.