Security & Trust

• All traffic to airaw.ai is served over HTTPS (TLS). Plain HTTP requests are permanently redirected to HTTPS.
• HTTP Strict Transport Security is enabled for airaw.ai and its subdomains.
• The application loads no content over plain HTTP; there is no active mixed content on Airaw pages.
• Data is encrypted in transit between the browser, the Airaw application and the Airaw backend.

• Accounts sign in with email and password or Google sign-in. Sessions use secure, HTTP-only cookie storage and short-lived access tokens with refresh.
• Password reset and invitation links are single-purpose and time-limited.
• Administrative access is a separate, explicitly granted role — it is never inferred from an email address or from anything stored in the browser.

• Authorization is enforced in the database with row-level security, not only in the interface. A request that should not see a row does not receive it.
• Campus isolation: campus staff can only read students linked to their own campus, through an active membership. Cross-campus and expired-membership access is denied server-side.
• Employer isolation: employers see candidates connected to their own jobs, drives and pipelines. Holding an employer account does not, by itself, grant access to student data.
• Individual data: students and job seekers control their own profile. Employer discoverability for job seekers requires explicit opt-in.
• Access to candidate data is logged with the accessing account, purpose and time, and can be restricted by Airaw administrators.

• Payments are processed by Razorpay. Card details are entered in Razorpay's own checkout and are never handled or stored by Airaw.
• Payment results are verified server-side against the provider's signature before any subscription is activated.

• Consent is recorded as append-only evidence with the document version the person agreed to. Optional consent is never pre-selected and never bundled with required terms.
• A privacy centre lets each account review consents, data sharing history, and request export or deletion.
• Uploaded files (resumes, imports) are validated by type and size and are stored as downloadable content only — user uploads are never served as executable web content.
• Application errors shown to users are generic; technical detail is logged privately and never rendered to the browser.

Airaw does not currently hold SOC 2, ISO 27001, PCI DSS or HIPAA certification, and does not claim to. Where a certification is obtained in future it will be stated here with its scope and date.

Email info@airaw.ai with a description of the issue and the steps to reproduce it. Please do not access, modify or download other people's data while testing. We acknowledge reports and will keep you updated on remediation.

Machine-readable contact details are published at /.well-known/security.txt.

If Airaw is blocked on your organisation's network, our IT & network requirements page lists every hostname the platform needs, and access help explains what to send us so we can identify where the block occurs.