Keep the browser narrow
Private reads and writes are required to pass through server-side Next.js application APIs. Browsers must never receive service credentials or direct access to private database tables.
Security & privacy architecture
Trust has to be built before private career data arrives.
MeritLog's release plan treats privacy and security as dependency gates. This page describes the controls required before accounts, uploads, private persistence, AI processing, or customer telemetry can be enabled.
This page is an architecture narrative, not a certification, compliance badge, or production-security claim.
Separate and encrypt
The approved design requires private schemas outside the Data API, forced owner isolation, least-privilege server roles, and application-layer encryption for the most sensitive content.
Prove the controls
Milestone 2 cannot pass on diagrams alone. Cross-user isolation, grants, encryption, uploads, deletion, telemetry, recovery, and failure behavior require executable evidence.
The trust gate
Deny first. Verify before enabling.
Archive the proven-local-only obsolete migration, unless any remote application is found; remote evidence immediately requires a forward correction.
Create the clean private data model with composite ownership, forced row policies, explicit grants, and server-derived identity.
Add encryption, private storage, quarantine, scanning, idempotency, request IDs, consent, export, and deletion foundations.
Test anonymous, owner, other-user, missing-identity, pool-reuse, malicious-file, telemetry, backup, and recovery paths.
Enable private surfaces only after the complete gate passes on production-shaped configuration.
Protected product preview
Your career, remembered. Your next move, prepared.
Private surfaces remain deny-by-default in this foundation slice.