Your resume is a detailed map of your life, so protecting it is a core part of how Handmade Resume is built. This page summarizes the technical and organizational measures we use. No online service can promise perfect security, but the practices below are designed to keep your information private by default.
Storage and access
Resume sources and generated files are held in private object storage, never in a public bucket. Files are served through short-lived signed links, and ownership is verified on every download, so a file can only be retrieved by the account that owns it. Application data is kept in an access-controlled managed database.
Encryption
Traffic between your browser and the Service is encrypted in transit using TLS. Files and application data are stored with our infrastructure providers, which encrypt data at rest.
Upload safety
Uploads are restricted by file type and size. We reject macro-enabled documents, encrypted PDFs, files with embedded attachments, malformed archives, and files whose signatures do not match a permitted, safe type, before they are processed.
Automated processing boundary
Document generation runs on specialized, access-controlled model infrastructure constrained to the task. We enforce a tight boundary around it in our system configuration:
- direct contact identifiers are kept out of model input and reinserted only when your documents are rendered. There is one exception we would rather state than gloss over: if you upload a photograph or a scanned resume with no text layer, the page is an image, so those details cannot be removed before it is read. That single transcription request sees the page as printed, under the same zero-retention terms below; the resulting text is then redacted exactly as a text resume would be, so every later step still sees redacted content only. A file that already has selectable text never takes this path;
- requests require zero-data-retention handling, so inputs and outputs are not retained by the underlying infrastructure and are not used to train third-party models;
- prompts and generated text are never written to our application logs; only non-sensitive metadata such as token counts and timing is recorded for cost and reliability monitoring; and
- the processing path has no web-browsing, web-fetch, or plugin capability, so it cannot reach outside the request.
Authentication and access control
Sign-in is handled by a dedicated authentication provider; we do not store your password. Internal access to systems and data is limited to what is needed to operate and support the Service.
Content-free monitoring
Our analytics and error monitoring are configured never to receive document text, employer names, job descriptions, or contact details. This lets us keep the Service reliable without exposing your career information.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you have found a security issue, please email support@handmaderesume.com with enough detail to reproduce it, and give us a reasonable opportunity to address it before disclosing it publicly. Please do not access or modify other users' data, degrade the Service, or run automated scans that could harm availability.