Security at EliteApply

Account access and sessions

Application workspaces require an authenticated account. Email confirmation, password reset and password-change flows are available for email-and-password accounts.

The browser client keeps active access and ID tokens in memory instead of localStorage or sessionStorage. Session restoration uses the server-issued HttpOnly refresh cookie, and signing out asks the service to invalidate the session.

• Use a unique password and keep email access secure.
• Do not share passwords, confirmation codes, deletion codes or private access links.
• Sign out on shared devices and report unexpected account activity promptly.

Documents and downloads

Uploaded documents expose a security-scan status. Downloading and linking a document to protected workflows remain disabled until the API marks that file as usable.

Downloads are requested on demand. The client validates returned download locations and only opens supported HTTP or HTTPS destinations.

• Document owners can download or delete files from the authenticated workspace.
• A rejected or failed file stays blocked from protected workflows.
• File names and content can still be sensitive; share them only with intended recipients.

Invitations, references and private links

Some collaboration and referee workflows use private invitation or access links. Possession of one of these links may provide access to a limited workflow, so treat it like a secret.

The frontend keeps sensitive invitation values out of product analytics properties. A temporary collaboration token may be held in session storage while an invitation is being accepted, then removed.

Data controls

Authenticated privacy settings provide a JSON data-export control and an account-deletion flow protected by a code sent to the account email address.

Individual document areas also provide deletion controls. These tools reduce reliance on support for routine access and deletion requests.

Operational signals

API requests include a correlation identifier to support troubleshooting. First-party product events are sent through EliteApply's API with a client-side filter that rejects sensitive-looking property names such as password, token, code, essay, reference and profile.

No analytics filter can make it safe to place secrets in ordinary form fields, URLs or support messages. Use the dedicated product controls for confidential content.

Assurance scope

EliteApply does not claim SOC 2, ISO 27001 or another external security certification on this page. We also do not describe encryption-at-rest, infrastructure isolation or recovery objectives without verified production evidence.

Security controls reduce risk; they do not remove it. Keep independent copies of time-critical application material and verify provider deadlines outside EliteApply.

Report a security concern

Email support@eliteapply.net with the subject “Security report”. Include the affected page or feature, a clear description, reproduction steps and the time you noticed the issue.

Do not send passwords, access tokens, deletion codes, confidential references or unnecessary personal data. Please allow us to investigate before publicly disclosing a vulnerability.