Privacy boundaries and verification

JobOfferMaster trust and verification

Privacy claims should be specific enough to test. This page documents what Private Mode encrypts, what remains visible, when plaintext is processed, and what you can verify in your browser.

Run verificationView trust.json
Local verification

Test the shipped encryption code

This test uses the same browser cryptography functions as Private Mode. It creates temporary keys and ciphertext in memory. The test routine does not transmit its generated key, recovery code, plaintext, or ciphertext.

No test has run in this browser session.

Claim ledger

Each statement is bounded by its known limitations. “Implemented” describes current product behavior; it does not mean the complete system is certified.

implemented

Supported private-vault payloads are encrypted in the browser before they are uploaded for storage.

Limitations

  • The encrypted payload boundary does not include every metadata field.
  • User-invoked AI and parsing features can transmit selected plaintext for transient processing.
  • When server-side practice tracing is enabled, LangSmith retains full job descriptions and PII-redacted resume, prompt, generated question, and preparation content for evaluation.
implemented

The server stores a recovery-wrapped account key, not the raw account master key or recovery code.

Limitations

  • A compromised browser, extension, unlocked device, or malicious client deployment is outside this storage threat model.
implemented

The current new-account sign-in and setup flow selects Private Mode by default.

Limitations

  • Existing accounts can contain legacy standard-mode data until migration completes.
disclosed

Private-vault data remains encrypted at rest, but selected decrypted content is processed transiently when a user invokes AI or parsing features.

Limitations

  • These requests are not end-to-end encrypted from the browser to the model provider.
  • Enabled practice-generation evaluation traces are retained outside the encrypted vault. Rule-based PII redaction is not a guarantee of anonymity; professional history can remain identifying.

Data boundaries

“Encrypted vault” applies to the payload fields below. It does not apply to every account field, index, filename, or user-initiated processing request.

Encrypted before storage

  • Structured profile contents
  • Application record contents, including descriptions, notes, contacts, and timelines
  • Resume and cover-letter contents
  • Quick-note contents
  • Interview-preparation answers and practice history
  • Uploaded document contents

Stored as plaintext or operational metadata

  • Account identity, provider, session, and storage-mode state
  • AI token/call counts, estimated costs, feature/model labels, timestamps, and authenticated account ID when available (admin-only usage reports)
  • When practice tracing is enabled: LangSmith evaluation traces with full job descriptions, PII-redacted resumes/prompts/generated questions and preparation content, opaque generation IDs, model/prompt versions, and usage metrics; retention follows the LangSmith project settings, separately from vault deletion
  • Record type, opaque logical ID, schema version, and timestamps
  • Recovery-wrapped key, wrapping nonce, KDF salt, and KDF parameters
  • Profile has-resume and has-cover-letter flags
  • Application company, role, status, applied date, job URLs, and record timestamps
  • Resume name, version, filenames, file type, master and active flags, parent ID, tailoring job and company, usage and outcome counters, and timestamps
  • Document filename, file type, size counters, source URL, content preview, custom metadata, and timestamps
  • Quick-note label, type, has-description flag, and timestamps
  • Interview-question type, category, difficulty, importance, companies, tags, practice counters, and practice timestamps

Processed as transient plaintext

  • Selected resume and job-description text sent for user-invoked AI analysis or tailoring
  • Uploaded document contents sent for user-invoked parsing
  • Selected decrypted vault excerpts sent for user-invoked assistant requests

Kept on the device

  • Raw account master key
  • Recovery code

AI is a separate boundary

Private Mode protects saved vault data at rest. When you explicitly run matching, tailoring, parsing, or assistant features, the selected decrypted content is sent through JobOfferMaster’s server and may be sent to the configured AI provider for that request. Those requests are not end-to-end encrypted to the model.

Threat model

Designed to protect against

  • Reading encrypted vault payloads from a database or backup without the account key
  • Direct plaintext storage of supported private-vault payload fields in encrypted record and blob rows
  • Undetected ciphertext modification through AES-GCM authentication

Does not protect against

  • Compromise of an unlocked browser, extension, or device
  • A malicious or compromised client deployment
  • Plaintext metadata explicitly listed in this manifest
  • Plaintext selected for a user-invoked AI or parsing request
  • Loss of both every local key copy and the recovery code

Open verification work

Encrypt sensitive indexes

Replace readable application and document metadata with minimized opaque fields and keyed fingerprints where duplicate detection is required.

Enable release verification

Bind deployed web and extension artifacts to source commits so authorized reviewers can compare the shipped client with the reviewed implementation.

Complete independent review

Commission an external assessment of key management, metadata leakage, client delivery, request logging, and AI processor boundaries.