Security & data handling
Access, processing and deletion in the Resume Parsing API. The controls your integration can use, and the terms to confirm before sending production data.
Discuss security requirementsAPI controls
Your integration has concrete controls for credentials, callbacks and the data returned by the API.
API keys belong to a project and environment. Endpoint scopes control the operations a key can perform. Use separate test and live keys, and keep them on your server.
A test key identifies an environment; it does not make parsing simulated or unlimited.
Authentication and scopesThe raw API key is shown once. Store it in a secret manager. Rotation revokes the previous key immediately; key management can require an MFA step-up.
Update your integration when you rotate a key. Never embed it in browser code.
API key managementWebhook destinations must use HTTPS. Deliveries use HMAC-SHA256 signatures with a timestamp and nonce. Your receiver verifies the original request bytes before accepting an event.
Verify freshness and store delivery identities to reject replays and duplicate deliveries.
Webhook verification guidePublic results contain projected parsing data. Internal raw_text, storage object keys, provider traces and internal parser configuration are stripped from the result response.
Request history also excludes internal payloads, fingerprints, storage paths, hashes and secrets.
Result handlingModel-use policy
Customer resumes are not used to train models by default. This is CVault's policy commitment.
Before production use, confirm the model providers and data-processing terms that apply to your deployment.
Read the privacy policyCancelling a job stops work. Erasure requests cleanup. They are different operations.
DELETE /v1/parse-jobs/{job_id}/erasureSaved documents and external copies need their own lifecycle handling.
Once erasure is accepted, result reads are blocked. Cleanup may return erasing with cleanup_pending: true; poll until erased.
Before production
A control described here is not a certification or a substitute for your security review. These are the topics to resolve together.
Start a security reviewConfirm where data is processed and stored, which providers are used, and the applicable region, encryption and subprocessor terms.
Agree retention periods for source files, parsing results, saved documents and operational records. Include provider-held data and copies outside CVault.
Review your lawful basis for sharing resume data, the DPA and the responsibilities of each party for the proposed deployment.
Discuss incident contacts, any required security evidence, availability expectations and whether an SLA can be agreed.
Further reading
Customer resumes are not used to train models by default. This is CVault's policy commitment. Confirm deployment-specific model and provider terms as part of your data-processing review.
No. Cancellation stops queued or running work and retains completed documents. Use the job-erasure endpoint for source, result and cache cleanup, then poll until erased.
No. Operational audit and metering records remain. Separately saved processing-workspace documents, exports and copies held by your webhook receiver require their own lifecycle handling.
DPA support is customer-scoped. Contact CVault to review processing terms, providers, retention and the security requirements for your intended deployment before sharing production resume data.
This page does not assert SOC 2 or ISO 27001 certification. Ask us for the evidence available for your security review; do not infer a certification from the controls described here.