You are handing this your career history. Here is exactly what happens to it.

It is yours, and it leaves in one file

Everything you write belongs to you. Your account settings include an export of your career record and everything you made from it, as a single archive, with the files you attached inside it, at any time, on any plan, including the free one. There is no paid tier required to get your own work back out, and no export queue. What the export leaves behind is listed in the privacy policy.

This matters more than it sounds. A career record you cannot remove is a career record held hostage, and the entire argument of this product is that the evidence should outlast any one tool, including this one.

What is never done with it

• •Never sold. Not to recruiters, data brokers, advertisers, or anyone else.
• •Never used to train AI models. Your evidence is used to answer your own requests and nothing else.
• •Never shown to employers. This is a place you build evidence, not a place you are listed. No employer browses profiles here, because there are none. A case study reaches someone only if you send them its link.
• •No ads, no ad tracking. The product is funded by subscriptions, which is the whole reason it can promise the three above.

Who else can see it

Nobody, unless you invite them or send a case study or the evidence behind a résumé as a link. There is no public profile, no organization that can look over your shoulder, and no default that opens your record to anyone.

You can invite one person at a time (a résumé writer, a coach, a counselor, a mentor) into specific experiences you tick one by one. Nothing is shared by default, anything you leave unticked is never listed or counted to them, and being able to read a record is never the same as being able to download the files attached to it. You set how long it lasts, and you can end it in one click. Both are enforced on every single request, so a page they already have open stops working too. If the person you invite works in a firm here, the access is with the firm: it may assign your engagement to another of its professionals, you always see who has it and the firm’s name, and you can end it with the firm whenever you choose.

They cannot change anything. A collaborator proposes wording and says why; you see their version beside yours and accept, reject, or ask them something. Nothing they write enters your record unless you accept it, and who suggested it and who accepted it is kept for twenty-four months.

One asymmetry worth stating plainly rather than leaving you to find out: a professional working with you keeps private working notes that you cannot read. They are that person’s own thinking about the engagement, they are never part of your evidence or anything you export, and they are destroyed with the rest of it when you delete your account. We would rather tell you they exist than have you assume they don’t.

Professionals are verified by a person before anyone can invite them, because handing over the record of your career is not something that should be available to whoever signs up.

Support staff can look up an account to answer “it isn’t working”: whether you are past the threshold that unlocks the AI tools, and whether your monthly allowance is spent. That screen does not show your evidence.

Where it lives

Your data is held in a managed Postgres database hosted in the United States, with encryption in transit and at rest. Sign-in uses an emailed link rather than a password, so there is no password of yours to store or leak. Payments are handled entirely by Stripe, and card numbers never reach this system.

What AI can and cannot see

When you ask for an analysis, the relevant evidence is sent to a large language model provider to produce that specific result, and comes back to you. It is not retained by the provider for training. Nothing is sent anywhere until you ask for it, or a professional you invited asks on the records you shared, or our staff ask during an engagement you booked: the manual path through the entire method involves no AI call at all, and works on every plan.

Mark any experience to keep it out of AI and it is left out of every AI request: it is filtered when your record is read, before anything reaches a model. And if the AI is unavailable, the steps that use it carry on without it: you can have a posting read by rule, your experiences are matched to it by their words, and the page says that is what you got.

AI here also has a hard constraint that matters for privacy as well as honesty: it only ever works from evidence you wrote. It does not enrich your record from outside sources, look you up, or import anything about you from the internet.

The No Unsupported Claims Principle

That constraint has a name, because it is the rule the rest of the product is built to keep: nothing Standing Proof produces should contain a claim that does not trace back to something you wrote down yourself, not an accomplishment inferred from a job title, not a number nobody entered, not a capability assumed from an industry or a seniority level. How it is kept: your résumé’s experience lines are your own records, compiled; an AI draft is written only from the experiences you choose; and any figure in a draft that is not in what it was given is shown to you before you keep it.

The limit on that promise matters as much as the promise. We can guarantee where a claim came from. We cannot verify that it is true, and we will not pretend to. Whether your record is accurate is yours to answer, and it should be, because it is your name on the document and your voice in the room. What this product owes you is the guarantee that it never put words in either.

For programs and institutions

If you are evaluating this for a cohort, three things usually come up in procurement, so here they are directly.

Participants own their records, not the program. A sponsoring organization does not receive participants’ career histories. Cohort reporting is aggregate: how many claimed a seat, how many built a working evidence base, how many stayed active. Counts, not contents.

No participant payment data is involved. Class codes grant access without a card, so participants never enter payment details and the program is not processing anything on their behalf.

For your security reviewer: the security overview covers architecture, residency, and subprocessors, the accessibility statement says what has actually been measured, and a standard DPA is available on request.

The record survives the program. When a class grant ends, the participant keeps their account and everything in it on the free plan. Nothing is deleted because a cohort concluded.

Deleting your record

There is a delete button in Settings. It destroys every experience, opportunity, résumé, interview session and growth item in the account, and it cannot be undone. Export first if you want to keep the record; the export is one archive, with up to 250 MB of your files inside it and the rest listed.

What survives is small, and none of it is your record. If you took part in a sponsored cohort, deleting your account adds one to a counter on that cohort recording that a seat was taken by someone who has since left. The counter carries no name, no email, no timestamp and none of your results. A record that your sign-in used the class code is kept too, so the same sign-in cannot take a second seat. It exists so a program that was already shown “24 of 30 claimed” does not later see 23, with a seat appearing never to have been taken. Your outcomes are not frozen into the report either: once you are gone, the cohort counts only the participants still there.

Your sign-in email is kept, on purpose. Not because deleting it is difficult. It is retained so we know an account once existed at that address, which is what stops free grants and class codes being claimed over and over by deleting and signing up again. It is an address with its sign-in timestamps: once your record is gone it is attached to no career history and no results of any kind, and signing in again simply starts a new, empty account. Ask us and we will remove it. Everything kept, the backups and Stripe’s own payment records included, is listed in the privacy policy.

A purchase keeps its receipt, not you. If you bought a quoted service, filled in an intake form, bought a gift or booked a call, the commercial record remains with your name, address, phone number and anything you wrote replaced by “Deleted account”. The amounts, dates and status stay, because an invoice is not ours to erase.

That is a deliberate trade against a real abuse problem, not a gap we are hoping you will not notice, and it is the one thing on this page where we keep something after being asked not to. If you want the address removed as well, email us and we will do it, no questions and no retention script.

What is not built yet

There is no formal third-party security certification such as SOC 2. If your institution requires one, that is a real constraint and this is not the tool for you yet. Saying so is more useful than implying otherwise. What does exist (the architecture, subprocessors, residency, and a plain list of what is and is not in place) is written up for reviewers on the security page.

The full legal versions

This page is the plain-language summary. The privacy policy and terms of service are the binding documents, and they are written to be readable rather than to be survived.