Last updated 15 August 2026
Counsel is an assistant for running a job search. You create an account, and everything you put in it belongs to you. It holds the most sensitive thing a working person owns about their career: that they are looking, what they think of their current employer, what they are paid, and who is quietly helping them. The rest of this page is about how that is handled.
Your content is encrypted with a key that only your password unlocks. We do not store your password, and we cannot derive that key without it. A copy of the database, a console session, a stolen backup or a legal demand served on us produces ciphertext.
The key itself is held in your browser session while you are signed in, sealed so that the cookie alone is not enough either. Signing out removes the only unwrapped copy.
This covers the content across 18 kinds of record: your resume, your positioning and career narrative, job descriptions, evaluations, generated resumes and cover letters, the text of messages, interview notes, contact notes, your answers to application questions, and everything you type into the assistant.
Encryption has a cost, and pretending otherwise would make the rest of this page worth less. Some fields have to stay readable because the app sorts, filters and groups on them, and ciphertext has no order. Those are: your email address, the names of employers you are tracking, job titles, the names of your contacts, statuses and dates.
So somebody with the database can see that you are tracking a role at a particular employer. They cannot see the job description, what the app said about it, what you wrote to anybody, or any note you made.
This protects your data at rest. It does not protect against the application itself: Counsel decrypts your content in memory to read a job description or draft a letter, so whoever runs it could in principle change the code to capture that. It is the same trust boundary a hosted password manager operates behind.
We are telling you this rather than claiming something stronger, because a promise you cannot check is worth less than a limit you can.
A recovery code is shown once when you create your account. It unlocks the same key your password does. Without either, your content cannot be recovered by us or by anybody else, which is the same fact as the first section of this page read from the other side.
In a Postgres database hosted by Neon, served from Vercel, both in the United States. Backups are Neon's and inherit the encryption above: a backup of encrypted content is encrypted content.
Connecting a mailbox is optional and off unless you turn it on. If you do, Counsel reads messages relevant to your search so it can file them against the right role, and sends only messages you explicitly press send on. Connecting Drive lets it file your documents into folders you already have.
Google user data is used only to provide those features, is never sold, never used for advertising, and never used to train any model. It is stored under the same encryption as everything else. You can disconnect at any time from Settings, and revoke access in your Google account, which stops it immediately.
Counsel's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Evaluating a role and drafting a document sends the relevant content to Anthropic or Google, decrypted for that request only. Neither provider trains on data sent through their APIs. This is the one place your content leaves the application, and it happens because you asked for something that needs it.
Deleting your account deletes your data. Not a flag, not a queue: every row that belongs to you is removed by the database itself in the same operation, which is how the schema is built rather than something a script is trusted to remember.
Questions about any of this, including anything you think is wrong or overstated, go to privacy@ecuris.com.