Security

1Job keeps personal data, so we keep the design simple and tell you plainly what is protected.

On your computer

• Records, answers and resumes are encrypted in the extension’s own storage. They are opened with a key that the 1Job server gives only to your signed-in extension.
• Web pages cannot read your vault. Everything read from a page is treated as untrusted data.
• Passwords, card numbers, ID numbers, one-time codes and CAPTCHA tokens are never recorded. Only real PDFs are stored as resumes.
• The extension asks for the fewest permissions it can.

On our server (optional backup)

• Resumes are encrypted before they are stored in a private storage bucket, with keys managed in Google Cloud KMS. Nothing is public.
• Your application records are in a database that is encrypted at rest, over TLS.
• Other users cannot read your files.
• The operator can decrypt backed-up resumes to provide the service, by design. Every such access is recorded in an audit log, and we will ask your consent before using them for anything new.

Known limits

If you type a secret into an ordinary text field that does not look sensitive, it is recorded as typed. Malware on your computer while the vault is unlocked can read what 1Job can read.

Report a vulnerability

Please email [email protected] with steps to reproduce, and do not post it publicly first. We aim to reply within a week.