Trust
Security & data
Your résumé holds your work history and contact details. Here’s exactly how we look after it, without the marketing gloss.
Last updated October 5, 2026
Our principles
- Collect less. We only ask for what the product needs to work.
- Your data is yours. Export it or delete it whenever you like, from Settings.
- No selling, no ads, no training. Your content isn’t sold, used for advertising, or used to train AI models.
What we do
| Area | Measure |
|---|---|
| In transit | All traffic uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP |
| Passwords | Never stored in plain text: hashed with scrypt, a slow, salted algorithm. You can also sign in with Google |
| Sessions | HTTP-only, secure session cookies; sessions expire and can be ended by signing out |
| Access control | Every page and action checks that the data belongs to the signed-in user; shared résumé links are opt-in, revocable and hidden from search engines |
| Abuse protection | Rate limits on sign-in, sign-up, uploads and AI features; daily AI quotas per account |
| Browser security | Security headers including HSTS, clickjacking (frame) protection, MIME-sniffing protection, a strict referrer policy and a restrictive permissions policy |
| Backups | Nightly, compressed and integrity-checked backups to Cloudflare R2 (encrypted at rest); we keep the latest 14 |
| Uploads | Files are converted to text and not stored; free-tool uploads are discarded immediately |
AI and your data
When you use an AI feature, we send only the text that feature needs to our AI provider (Anthropic, or OpenAI as a backup) over an encrypted connection. Under their commercial API terms, that data isn’t used to train models. AI never changes your résumé on its own: every suggestion waits for your approval, and our checks reject suggestions that invent numbers or experience you don’t have.
Browser extension
The GotOffered extension for Chrome, Edge and Firefox only reads a job page when you click to save it, uses a token you can revoke at any time in Settings, and never reads other sites or your browsing history.
What you can do
- Use a unique, strong password, or sign in with Google.
- Turn off résumé share links you no longer need.
- Revoke the browser extension’s access if you stop using it.
- Download your data from Settings whenever you want a copy.
Reporting a vulnerability
If you believe you’ve found a security issue, please email hello@gotoffered.com with steps to reproduce. Please give us reasonable time to fix it before disclosing it publicly, and don’t access other people’s data or degrade the service while testing. We’ll acknowledge your report and keep you updated.
For how we handle personal data, see the Privacy Policy.