Is It Safe to Upload Your Resume to an AI Tool?

A resume is an unusual document: sensitive enough that you wouldn't post it publicly, yet designed to be handed to strangers. Uploading it to an AI tool is not inherently risky — you already send it to every employer's ATS — but the risks that do exist are concrete and worth naming, especially since we run one of these tools ourselves.

The actual risks, ranked

• Contact-data resale. The worst offenders in the career-site world aren't AI tools; they're "free resume post" job boards whose business is selling your phone number and email to recruiters and lead-gen brokers. Any tool whose policy mentions sharing with "partners" for their marketing deserves a hard no.
• Model training. Some services use uploads to improve their AI. That means fragments of your history could inform outputs shown to others. Look for an explicit statement about training; its absence is a red flag.
• Indefinite retention. Data held forever by a service you used once in 2023 is pure liability — every old database is a future breach candidate. Self-service deletion is the mitigation.
• Ordinary breaches. The same risk every online service carries. You limit the blast radius by uploading less (see below), not by avoiding tools entirely.

The 7-point checklist before uploading anywhere

• 1. Does the privacy policy say plainly that personal data is not sold?
• 2. Does it address whether uploads are used for AI training?
• 3. Can you delete your account and data yourself, from a settings page?
• 4. Is there a real company behind it — legal entity, contact address, support email that answers?
• 5. Is the connection HTTPS and the checkout handled by a known processor (Stripe, Paddle, PayPal)?
• 6. Does the tool ask only for what it needs? A resume tool has no business requesting your date of birth or ID numbers.
• 7. Are there independent reviews or coverage, and how does the company respond to complaints?

Minimize what you upload

The cheapest protection costs nothing: strip your street address (city and country are enough on a modern resume), never include ID numbers or your date of birth, and consider using a dedicated job-search email address. This protects you not just with AI tools but with every ATS and job board your resume will pass through.

Where we stand

Since this article is published by a tool vendor, here are our own answers to the checklist: OneTwo Resume does not sell personal data, resume uploads are processed through commercial AI APIs (not used by us to train models), data is encrypted in transit, and you can delete your resumes and your account yourself from the dashboard. The full detail — including which third-party processors touch your data and our data deletion practices — is on the security and data page and in the privacy policy. Apply the same checklist to us as to anyone.