How we protect your resume

A resume holds your name, your contact details and your whole working life. We treat it that way: encrypted when we keep it, not kept at all if you'd rather, and erased, not just hidden, when you delete it.

What we keep, and what we don't

• Resume X-ray: your file is read in memory and not stored, unless you're signed in and tick "Save to my account". We keep the text we read, never the file.
• Saved resumes: encrypted as above, and only your signed-in account can open them. They're never shown to employers, recruiters or other members, never sold, and never used to train AI models.
• What isn't encrypted: so your library can list them, we store a version's name, the job title and employer it's for, its status (draft, ready, sent) and what happened, without encryption. No resume text, contact details or notes are among them.
• Our staff: our staff console shows how many resumes an account has, never what's in them. The one exception is a professional review you ask for: a reviewer reads that one resume until the review is sent, every opening is logged, and their copy is deleted when the review is sent or you cancel.
• AI features: written recommendations, tailored drafts, Fix all and cover letters send the text needed for that one request to Anthropic's API (the Claude models). Under Anthropic's commercial terms, API data isn't used to train its models. Ratings, matching and checklists run on our own server with no AI call.
• Apply assist: your apply profile goes only to a browser you connected with a one-time code. We keep a fingerprint of the code, not the code. The extension fills forms on your computer and never sends a form's contents to us.

How deletion works

• One resume: delete it from its page; its versions, cover letters, notes and logged applications go with it.
• Everything: "Delete all saved resumes" on Your resumes, or delete your account from its settings page. Deleting the account erases your sign-in details, saved resumes and versions, cover letters, notes, applications, apply profile and connected browsers, your search story, analytics about your account and any waitlist entry under your email. Any subscription is canceled first.
• Overwritten, not just unlinked: our database runs with secure delete on, so deleted data is overwritten with zeros, and its change log is flushed and cleared right after an account is erased.
• Backups: one encrypted copy of our database is made each night and kept for 30 days on a second server we run. A deleted account stays in older copies until they expire. Each deleted account's number goes on a list kept outside the database and its backups; if we ever restore a backup, every account on that list is erased again before the site starts.
• What stays: Stripe keeps its own payment records under its terms, and our security log keeps the network addresses of requests that tripped our protections for 30 days. Neither holds resume or profile content.
• Take it with you: "Download my data" on your account page gives you everything we hold for you, in one file.

How the site is protected

• Every connection is encrypted (HTTPS only, with HSTS). Passwords are stored as Argon2 hashes, which can't be reversed. Two-factor sign in with an authenticator app is available, and the secret is encrypted.
• Resume files are parsed in a separate, locked-down process with memory, CPU and time limits, so a malicious file can't reach the rest of the server.
• Strict security headers on every page (Content Security Policy, no framing), checks against cross-site request forgery on every form, rate limits on sign in and checks, and automatic blocking of abusive traffic.
• The site and the job scanner run on separate servers. The staff console isn't on the public internet: it's reachable only over a private network, with two-factor sign in, and every action is logged.

What we don't claim

• Encryption at rest protects your resume if a disk or a backup leaves our hands. The key lives on our server, because the site has to read a resume to rate it, so this isn't end-to-end encryption. If you'd rather we kept nothing, choose "Don't keep my resumes", or use the X-ray without saving.
• No system is perfectly secure. If we ever learn that member data was exposed, we'll tell affected members by email, promptly, with what happened and what we're doing about it.

Questions or a security report: info@resume-pilot.io. See also the privacy page.