You give Cairn the most sensitive stream in a job search. This page lists what we store, how long we keep it, where it lives, and who else touches it.
Data access goes through a per-request Postgres session carrying your user id. Row-level security policies enforce isolation in the database, not only in application code.
Each secret gets its own AES-256-GCM data key, wrapped by a master key that lives outside the database. Rotation re-wraps keys without touching payloads.
The intelligence layer receives email body text and posting text only. Tokens, passwords and portal logins are never included in a prompt.
Inbound email, Telegram, Twilio, WhatsApp and Stripe webhooks verify signatures. Sessions are database-backed and revocable; cookies are httpOnly, Secure and SameSite.
Retention runs from the event, or from account deletion where noted. A weekly job enforces the fixed periods. Backups are not configured yet; the planned database restore history covers seven days or less.
Portal passwords, mailbox app passwords, private calendar addresses and model API keys are encrypted before they reach the database. Each secret gets a fresh 256-bit data key and AES-256-GCM encryption. The data key is then wrapped by the active master key.
Master keys exist only in the runtime environment or a KMS. The database never holds them. Rotating a master key re-wraps data keys without re-encrypting payloads.
Your user id is bound to every secret as authenticated data. A row cannot be re-attributed to another account, even by a privileged database user.
Reads are logged in the audit trail you can see in Settings → Security. Staff cannot read plaintext; there is no support tool that decrypts.
Portal sign-ins are saved only if you ask
Connected mailboxes are read-only
Deterministic rules handle most mail. When a model is called, it receives redacted text and a fixed output schema.
Via a connected mailbox, forwarding where it is available, the companion or a board sync. Mail from a connected mailbox that is not about your search is dropped here by fixed rules.
Sender, subject and phrase rules classify most ATS mail with no model call.
Addresses, links to portals, tokens and anything in the vault are stripped from the text.
Only the redacted text and a fixed schema go to the provider. Your key or ours, your choice.
Stage, confidence and the justifying excerpt are stored. Low confidence waits for your review.
Never sent: passwords, OAuth tokens, portal logins, API keys, payment details, your contacts’ phone numbers.
We notify account holders by email 30 days before adding a subprocessor. Model providers run under your key when you supply one.
Access control, change management, vendor review and incident response policies are written and in force. We will publish the Type I report when the audit completes, and begin the Type II observation period immediately after.
Greenhouse, Ashby and Lever public board APIs are read nightly for companies you watch. BLS, FRED and SEC EDGAR are public records. No scraping behind a login, and nothing is fetched from LinkedIn or Indeed by our servers.
Write to security@getoncairn.com. We acknowledge within 2 business days and share a fix timeline within 7. We do not pursue good-faith researchers who respect user data.
These are buttons in Settings → Data, not support tickets.
A JSON archive and CSV tables of every application, event, note and message, generated on demand. Contacts export as CSV; the metrics table can also be read with a personal API key.
Deleting your account starts a 30-day grace period in which you can cancel. When it ends, a daily job erases the account, its records, vault secrets and stored files from the live database and file storage. Backups are not configured yet; once they are, deleted data will leave them when the provider's restore window passes.