Privacy & Security

• All traffic between your browser and our servers is encrypted with HTTPS/TLS.
• Data is encrypted at rest by our backend provider.
• Passwords are stored as salted hashes — staff and admins never see your password.
• New and changed passwords are checked against the Have I Been Pwned database to block known-leaked credentials.

• Students can only view and edit their own profile, applications, saved opportunities, and career-development data.
• Employers can only view information about opportunities they have posted and the students who applied to those opportunities.
• Admins have elevated access for managing the platform. All administrator actions are recorded in an audit log.
• Access controls are enforced server-side at the database layer, so a user cannot reach another user's data by editing a URL or crafting a request.

We treat student information — including grade level, school, profile data, applications, and reflections — as education records and follow FERPA-aligned best practices. Student records are:

• Accessible only to the student themselves and authorized school administrators.
• Not sold or shared with third parties for advertising.
• Shared with an employer only after the student has actively applied to that employer's opportunity.

Security-relevant events — sign-ins, password changes, opportunity postings, administrator actions, and role changes — are recorded in an audit log that only administrators can view. Audit entries cannot be edited or deleted by ordinary users.

• Update your profile information from your profile page.
• Change your password and sign out of all devices from the "Account security" section of your profile.
• Delete your own reflections and applications at any time from your dashboards.
• Contact a administrator to request deletion of your account.

Questions about your data or a possible security issue? Reach out to your Oveus career services administrator. We take reports seriously and respond as quickly as we can.