Security notice

Ace the Role is the interview-preparation app provided under the public business name QTS One. This notice summarizes how we protect account data, selected Role-Specific Paths, Practice Sessions, Practice Answers, Trusted Grades, Reference-Backed AI Feedback, billing access, support requests, and the Live Preparation Catalog. It is a public security summary, not a security certification or audit report, so it intentionally avoids disclosing sensitive implementation details.

Ace the Role is designed around EU expectations for appropriate technical and organisational measures under GDPR Article 32, including access control, confidentiality, integrity, availability, resilience, and regular review of safeguards. Our operating model is also informed by NIS2 risk-management themes such as incident handling, business continuity, supplier review, secure development, vulnerability handling, access control, and secure communications where appropriate.

Ace the Role uses passwordless email sign-in and authenticated sessions for account access. Protected product and support surfaces require valid account state, and administrative access is limited to authorized personnel. Sensitive account-support actions are reviewed, constrained, and recorded so misuse or mistakes can be investigated.

Ace the Role applies layered application safeguards for browser sessions, server-side integrations, deployment configuration, and stored product data. Sensitive provider and payment credentials are kept out of browser-visible code, and public pages are served with defensive browser protections appropriate for a modern web application.

Ace the Role stores Practice Answers, Trusted Grades, feedback records, usage limits, and account access records so it can provide history, progress, quotas, support, security, and reliability features. When you request grading, Ace the Role may send the relevant question context, reference material, and Practice Answer to configured AI grading providers. Do not submit passwords, identity documents, payment card data, employer-confidential material, medical details, or other sensitive information that is not needed for interview practice.

Stripe handles checkout, payment methods, billing portal flows, and approved refund transactions; Ace the Role does not store full card numbers. Resend is used for transactional email such as one-time sign-in codes and Practice Data Deletion confirmations.

Ace the Role uses abuse-prevention controls, access limits, issue-reporting channels, operational monitoring, backups, and recovery practices to protect the service and support paid access. We review operational changes that affect account access, billing access, Practice Data Deletion, and the Live Preparation Catalog.

Security incidents are triaged by containment, impact assessment, remediation, and recordkeeping. If an incident is a personal data breach that is likely to create risk for affected people, Ace the Role will assess notification to the competent supervisory authority within the GDPR 72-hour window. If the breach is likely to create a high risk for affected people, Ace the Role will also assess direct user communication without undue delay.

Report suspected vulnerabilities to security@acetherole.com. Include the affected URL or endpoint, reproduction steps, observed impact, timestamps, and any relevant request identifiers. Do not access, modify, delete, or extract another user's data, disrupt service availability, bypass quotas for non-testing purposes, or publish vulnerability details before we have had a reasonable opportunity to investigate. For machine-readable disclosure details, see security.txt.

Keep sign-in codes, account sessions, and billing portal links private. Contact support@acetherole.com if you believe someone else accessed your account, and contact security@acetherole.com for vulnerability reports. Personal data handling and Practice Data Deletion are explained in the privacy notice.