Privacy & Data Protection
How ResumeRoast protects your resume and personal information
ResumeRoast was built with privacy-first architecture. We understand that your resume contains sensitive personal information. Our system is designed to minimize data exposure, redact personally identifiable information (PII) before AI processing, and restrict access at every layer.
🔒 Our Security Architecture
Secure Upload & Storage
When you upload your resume, it is securely transmitted over HTTPS to our FastAPI backend. We immediately store the file in encrypted Amazon S3 storage.
- Encrypted data in transit (HTTPS)
- Encrypted storage in Amazon S3
- Restricted backend access controls
- No public file exposure
Resume files are not publicly accessible and are never exposed to external services in raw form.
PII Redaction Before AI Processing
Before your resume content is sent to any language model, it is processed by our internal redaction layer.
We use server-side PII detection logic to automatically remove or mask sensitive information such as:
- Full names
- Email addresses
- Phone numbers
- Physical addresses
- Identification numbers
This redaction process runs inside our backend before any AI call is made. The AI model never receives your raw personal identifiers.
AI Processes Only Anonymized Content
The AI model receives only the redacted version of your resume.
- Job responsibilities and achievements
- Skills and technical competencies
- Education details (without identifiers)
- Project descriptions
- Resume structure and formatting
This allows us to generate high-quality feedback while minimizing exposure of sensitive data.
🛡 Infrastructure & Access Controls
- • Server-side processing using FastAPI
- • Rate limiting using Redis to prevent abuse
- • Structured metadata storage in PostgreSQL
- • No selling or sharing of user data
- • Limited administrative access
Why This Matters
✅ What ResumeRoast Does
- • Redacts PII before AI processing
- • Encrypts files in storage
- • Restricts backend access
- • Minimizes raw data exposure
❌ What Many Tools Do
- • Send raw resumes directly to AI APIs
- • Store unredacted personal data
- • Lack clear access controls
- • Provide no transparency about data flow
Our Commitment
ResumeRoast is built with a privacy-first mindset. While no internet system can claim absolute security, we intentionally designed our architecture to minimize data exposure, redact personal information before AI processing, and restrict access to sensitive content.