Trust & security

This page is for reviewers, security folks, and anyone who wants the precise version of the claims we make in plain language elsewhere.

Architecture

CareerSeeker has no hosted pipeline. The application logic, the local SQLite database, generated documents, and all profile data reside on the user's Windows machine. The only network connections the application makes are to public job boards (to read postings), to the AI provider the user configured (to generate and verify text, under the user's own API key), and to Gmail (to create drafts, under the user's own Google authorization).

System architecture: all processing occurs on the user's machine; external connections are limited to job boards, the user's AI provider, and Gmail draft creation.

Google account access

CareerSeeker requests the gmail.compose OAuth scope. Google defines this scope as allowing draft management and sending. Our software uses it solely to create drafts: the shipping build's Gmail interface exposes no send operation, so no code path in the application can send email. Sending is always performed by the user, in their own Gmail.

OAuth tokens are stored on-device in a Windows DPAPI-protected vault. They are never transmitted to us — we operate no servers that could receive them.

Credential storage

AI provider API keys (for Anthropic, Google, or OpenAI) and Google OAuth tokens are encrypted at rest using Windows DPAPI, bound to the user's Windows account, and stored only on the user's machine.

Verification pipeline

Every factual claim in generated application materials is checked against the user's own profile data using natural-language entailment verification before a draft may be created. Claims that cannot be verified are blocked. This check is structural: the application state machine has no path to a completed draft that bypasses verification.

Autonomy contract

What the application may and may not do on your behalf — the permitted actions, the non-negotiable safety rules, and the controls available to you — is enumerated in the autonomy contract. It is versioned with the product.

What we can see

Approximately nothing. The beta contains no telemetry, no analytics, no crash reporting, and no account system. If that ever changes, this page will enumerate exactly what is collected, before it ships.

The governing document is our privacy policy. If this page and that policy ever disagree, the policy wins — and please tell us.