Trust & Security
We build AI tools designed for career autonomy. Here is exactly how we protect your documents, safeguard your privacy, and maintain zero-retention AI inference.
We Never Apply on Your Behalf
Autonomous bots that mass-apply without human review risk burning candidate reputations and triggering ATS spam filters. ResumeSquad AI optimizes your resume, uncovers matching jobs, and audits ATS alignment — but you review and submit every application yourself. You stay in 100% control of your career footprint.
Zero AI Model Training
Your resume, personal career history, and job descriptions are never used to train public or foundational AI models. We contract exclusively with enterprise AI providers (Google Cloud Vertex, Anthropic, OpenRouter) under commercial zero-data-retention agreements.
Encryption at Rest & Transit
All network communication is strictly enforced over TLS 1.3 with HSTS. Relational database storage (PostgreSQL) and vector databases (Pinecone) are encrypted at rest using AES-256. Inter-service backend requests are authenticated with HMAC-signed user assertions.
Evidence-Grounded AI Generation
Our Career Fact Ledger anchors the pipeline to verified evidence. Content that cannot be traced to your profile is rejected during synthesis or flagged by our adversarial audit agent before delivery. We do not invent qualifications or past titles.
1Authorized Sub-processors
We partner with institutional cloud and AI infrastructure providers to deliver reliable, secure services. All sub-processors undergo security screening and process data under binding data protection commitments.
| Sub-processor | Purpose | Region | Retention | Lawful Basis |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless edge compute, global CDN, and DNS management | United States / Global Edge Network | Ephemeral session runtime; access logs retained for up to 30 days | Legitimate interest (system availability and DDoS mitigation) |
| Supabase, Inc. (AWS us-east-1) | Primary PostgreSQL relational database, authentication store, and application state | United States (N. Virginia) | Account lifetime or until user-requested deletion; free inactive accounts purged after 90 days | Performance of contract (providing saved resume services) |
| Render Services, Inc. | Compute infrastructure hosting the multi-agent AI pipeline and document processing backend | United States (Oregon) | Ephemeral pipeline execution only; compute logs retained for up to 30 days | Performance of contract (executing requested resume optimization) |
| Upstash, Inc. (AWS us-east-1) | Distributed Redis caching, rate-limiting counters, and ephemeral research state | United States (N. Virginia) | Sliding window rate-limit keys expire in 1–60 seconds; research cache expires in 24 hours | Legitimate interest (abuse prevention and resource availability) |
| Pinecone Systems, Inc. (AWS us-east-1) | Vector database for semantic embeddings, RAG retrieval, and occupational taxonomy matching | United States (N. Virginia) | Account lifetime; deleted immediately upon account deletion or profile update | Performance of contract (targeted semantic matching) |
| OpenRouter, LLC | Secure AI inference gateway routing prompts to foundational model endpoints | United States | Zero-retention pass-through; requests are neither stored nor used for model training | Performance of contract (AI content generation) |
| Google LLC / Google Cloud Vertex AI | Foundational LLM inference (Gemini models) for resume drafting, keyword extraction, and embeddings | United States | Zero customer data retention; inputs and outputs are never used to train foundational models | Performance of contract (content generation and scoring) |
| Anthropic, PBC | Adversarial Red Team audit LLM inference for factual claim verification | United States | Zero data retention under commercial API terms; inputs are never used to train models | Performance of contract (anti-hallucination verification) |
| DeepSeek / OpenRouter | Reasoning and deterministic structural extraction model inference | United States / Routed via OpenRouter | Zero data retention via API terms; ephemeral stateless inference | Performance of contract (resume parsing and alignment) |
| Groq, Inc. | Ultra-low-latency LPU inference for the free ATS checker semantic keyword analysis and bullet rewrites | United States | Zero data retention; inputs are discarded immediately after inference and never retained | Legitimate interest / Performance of requested ATS analysis |
| Lemon Squeezy, LLC | Merchant of Record, credit pack billing, payment card processing, and global tax compliance | United States | Up to 7 years to satisfy statutory accounting, tax reporting, and audit requirements | Legal obligation (tax and fraud compliance) and Performance of contract |
| Google LLC (Google Analytics 4) | Aggregated site usage telemetry, traffic analytics, and conversion attribution | United States / Global | 14 months (subject to user consent in the EU/UK) | Consent (via analytics consent mode banner) |
| Functional Software, Inc. (Sentry) | Real-time error tracking, exception logging, and application performance monitoring | United States | 30 days rolling retention | Legitimate interest (application stability and security diagnostics) |
| Resend, Inc. (AWS us-east-1) | Transactional email delivery for account confirmation, password resets, and security notifications | United States (N. Virginia) | 30 days delivery logs and message status telemetry | Performance of contract (delivering essential account notices) |
2Automated Data Retention & Pruning Schedule
Active Candidate Data
Account LifetimeSaved resumes, weekly career wins, and verified career facts are maintained for your active career development until deleted by you.
Free Inactive Accounts
90-Day Auto PruneAccounts without paid package entitlements and without login activity for more than 90 days have resume text and generated deliverable artifacts automatically scrubbed and deleted by daily automated cron tasks.
Agent Execution Payloads
30-Day Auto PruneDetailed per-step multi-agent prompt payloads and error traces older than 30 days are purged automatically. Only non-identifying aggregate cost and latency metrics are retained.
3Self-Service Export & Deletion
We provide immediate, unmediated self-service controls to exercise your GDPR and CCPA rights:
4Scoring Methodology & Quality Telemetry
We hold our scoring and generation algorithms to empirical standards. Learn how our ATS parser works or inspect our empirical quality evaluations: