You are trusting us with more than a resume.
Severance math. Runway numbers. The things you would only write down at 1am. This page answers the question that actually matters: who can see it, and who cannot.
Every claim below maps to a specific control in our code. We keep a claims register, audited it in July 2026, and fixed what did not hold up.Get started freeWho can see what.
| What you put in | You | Offboard staffthrough the product | Lumoour AI guide | AI providersOpenAI and Anthropic |
|---|---|---|---|---|
| Your Career Contextwork history, projects, and outcomes | Yes. Always | No. No read path exists in the product | Yes. Yes. This is what it works from | Limited. Processed to run a feature you asked for, with retention off. Never for training |
| Resumes and documentsuploads, drafts, cover letters | Yes. Always | No. No | Limited. Only what you share in a conversation or run through a resume feature | Limited. Processed to power tailoring and parsing, with retention off |
| Money numbersseverance, runway, budgets | Yes. Always | No. Not shown in any admin screen. A database admin role exists for account support, and analytics store a risk band only | Limited. A computed runway estimate, only if you saved numbers and keep it enabled. Never the raw amounts | Limited. Only inside a feature you run, with retention off |
| Lumo conversationswhat you ask and what it answers | Yes. Always | No. No read path exists in the product | Yes. Yes. It is the conversation | Limited. Sent to generate the reply, with retention off. Never for training |
| Google Calendarif you connect it | Yes. Always | No. No | No. Excluded from AI context entirely | No. Never sent to AI models |
Your Career Contextwork history, projects, and outcomes
- You
- Yes. Always
- Offboard staff
- No. No read path exists in the product
- Lumo
- Yes. Yes. This is what it works from
- AI providers
- Limited. Processed to run a feature you asked for, with retention off. Never for training
Resumes and documentsuploads, drafts, cover letters
- You
- Yes. Always
- Offboard staff
- No. No
- Lumo
- Limited. Only what you share in a conversation or run through a resume feature
- AI providers
- Limited. Processed to power tailoring and parsing, with retention off
Money numbersseverance, runway, budgets
- You
- Yes. Always
- Offboard staff
- No. Not shown in any admin screen. A database admin role exists for account support, and analytics store a risk band only
- Lumo
- Limited. A computed runway estimate, only if you saved numbers and keep it enabled. Never the raw amounts
- AI providers
- Limited. Only inside a feature you run, with retention off
Lumo conversationswhat you ask and what it answers
- You
- Yes. Always
- Offboard staff
- No. No read path exists in the product
- Lumo
- Yes. Yes. It is the conversation
- AI providers
- Limited. Sent to generate the reply, with retention off. Never for training
Google Calendarif you connect it
- You
- Yes. Always
- Offboard staff
- No. No
- Lumo
- No. Excluded from AI context entirely
- AI providers
- No. Never sent to AI models
Sponsors are not a column here because they see none of it. That rule has its own section below.
Four things we can show you, not just say.
Only your account reaches your rows
Row-Level Security is enforced on every sensitive table in our database. Your session can only ever query data that belongs to you. Cross-account leakage is prevented at the database layer.
No admin read paths
There is no screen, role, or query in the product that shows our team your Career Context, your resume, or your finances. Those are blocked at the database layer, and money numbers are excluded from every admin query and screen.
Exactly two AI providers
OpenAI, called with retention disabled on every request, and Anthropic, whose API does not train on customer data. Nothing you write goes to any other AI company.
Delete means delete
Deleting your account removes your database rows and your uploaded files, across every storage bucket. Not just the visible parts.
A sponsor sees a number. A sponsor never sees you.
Your former employer, school, or workforce program may cover your Offboard access. That pays for the account. It does not buy a view into it.
That privacy line is contractual, not a preference. Not the CEO, not HR, nobody.
What a sponsor sees
- How many people claimed access
- How many are active
- Aggregate engagement and outcomes
What a sponsor never sees
- Your resume
- Your applications
- Your Lumo conversations
- Your money numbers
- Anything you write
A connection you authorize sends your record somewhere we do not run.
Offboard can connect to assistants you already use. Each one gets its own access level: full access, read only, or off. Full access can read and update your account and run tools that spend credits. Read only can see your account but cannot change it or spend credits.
From that point, the conversation lives in your account with that provider, under that provider's terms. You can change or turn off access at any time in Settings. Your record stays with Offboard.
See how connections workWhere the line actually sits.
Offboard does not use end-to-end encryption. Our AI features need to read your text as text: a resume tailor cannot rewrite a bullet it cannot see. That means our servers process your data in readable form, and, like every cloud product, the company that hosts our database and the people who hold our service keys could technically reach it.
We weighed the alternatives. On-device AI is not good enough yet to do this work. A key only you hold would mean one forgotten password erases your record forever, and it would break everything that helps you while you are away, like reminders and weekly summaries. So we chose readable processing plus strict access control, and we tell you exactly where the line sits. If that ever changes, it will change on this page first.
What stands between that technical possibility and a person reading your record: no admin read paths exist in the product, identifiers are minimized in our server logs, admin actions are written to an audit log, and every sentence on this page is tied to a control in our claims register.
We do not hold a SOC 2 or ISO certification, and we will not imply otherwise. When that changes, it will say so here.
For the reader who wants receipts.
Sign-in and sessions
Google sign-in and email magic links, handled by Supabase Auth with the PKCE flow. Sessions use short-lived tokens that refresh automatically. AI provider keys live only on our servers as encrypted secrets, and never reach your browser.
Your files
Resumes, documents, and voice notes live in private storage buckets keyed to your account. There are no public links. Files are served through time-limited signed URLs that expire on their own, with random filenames, a size cap, and file-type validation on upload.
AI, precisely
Two providers, no more: OpenAI and Anthropic. Every OpenAI request is sent with retention disabled, so your data is not stored or used for training, and Anthropic's API does not train on customer data. Google Calendar data is excluded from AI context entirely, under Google's Limited Use policy. We verified all of this live on 2 July 2026.
Validation and abuse limits
Requests are checked against a schema before we act on them. AI and abuse-prone endpoints are rate-limited per account.
Infrastructure and accountability
Our database and file storage are managed by Supabase, which encrypts data at rest and in transit at the hosting layer, not end to end. We minimize identifiers in our server logs: user IDs are truncated and emails are masked. Admin actions are written to an audit log. We maintain a claims register that maps every public security claim to the code that enforces it, and we ran a full audit and hardening pass against it in July 2026.
These are product features, not legal concessions.
You do not need to cite a regulation to use any of them.
- 01 See and edit everything you have put in, at any time.
- 02 Delete a single document, a single entry, or your whole account. Account deletion removes your files too.
- 03 Export your resumes and documents whenever you want.
- 04 We do not sell your data. To power AI features it passes through OpenAI and Anthropic only, under the retention and no-training terms above.
These map to the rights GDPR and CCPA give you, wherever you live. Found something, or have a question this page does not answer? Email hello@offboard.co. A human reads it.
Now you know exactly what you are trusting us with.
Build your Career Context knowing who can see it, who cannot, and what you can delete.
Independent support. Start free.