When a model is called
A model runs only when you take an action that needs one: extracting a pasted job description, analyzing a posting, importing a résumé into Career Brain, coaching or tailoring a résumé, checking a proposed edit, or drafting a cover letter. Browsing, exporting, deleting an account, and editing rows by hand do not call a model.
Local development and automated tests default to a deterministic fixture provider. Nothing is sent off-machine in that mode. Production and any live path you approve use Anthropic Claude.
What is sent to Anthropic
Each task sends only the fields that task needs. Career Brain rows sent to a model are confirmed rows, not pending import drafts. Extraction, Truth Guard, résumé rewriting, and career import never run on a local Ollama model.
| Task | Sent to Anthropic |
|---|---|
| extraction | The job-description text you pasted, or the readable text fetched from a posting URL you submitted. |
| analysis | Extracted requirements and preferred items, the posting text as context, and your confirmed Career Brain evidence rows. |
| career_import | Plain text extracted from a résumé DOCX you uploaded. Binary file bytes are not sent. |
| resume_coach | Résumé text, your target profile, and confirmed Career Brain evidence rows. |
| resume_tailor | Résumé text, role and company, extracted requirements, posting text as context, and confirmed Career Brain evidence rows. |
| truth_guard | Proposed résumé edits (original and rewritten text) plus the Career Brain evidence rows cited for those edits. |
| cover_letter | Role and company, extracted requirements, posting text, the company mission or values text you pasted, and confirmed Career Brain evidence rows. |
What is not sent
These stay in the app, or never exist as stored model logs.
- Your password.
- Binary résumé or artifact files. Text is extracted first; the archive stays in private storage.
- Other users' data. Row-level security keeps reads inside your account.
- Prompt text, job-description text, résumé text, or model output in the model_generations log. That table stores task, prompt version, model, token counts, and related ids only.
How output is treated
Job descriptions, résumé text, and uploads are delimited as untrusted data. They are never concatenated into instructions.
Extraction writes fields you can correct. Career import writes a confirm-or-reject queue; an unquoted invention is dropped before insert, and a draft is not a live Career Brain fact until you confirm it. Tailoring proposes edits that Truth Guard classifies as verified, reframed, or unsupported. An unsupported edit can be read and cannot be accepted. A generated DOCX is not a submitted artifact until you archive it.
You still decide what to send an employer. The guardrails reduce unsupported claims; they do not certify a document.
Anthropic as a processor
When the live provider is configured, inference runs on Anthropic's Claude API. We have not purchased a Zero Data Retention arrangement. Anthropic's retention and training terms are theirs; this page will name a ZDR contract if one is bought.
RoleVerity does not train a model on your data. Prompt versions are files in the repository with logged ids so a generation can be attributed. Cache is used for a stable Career Brain prefix so repeat calls do not resend that block in full; the cached content is still your Career Brain.